CVE-2026-56373

What it actually does

ImageMagick versions before 7.1.2-15 contain a use-after-free flaw in the PDB image decoder. When ImageMagick processes a specially crafted PDB file and an allocation failure occurs, the decoder can continue using a stale pointer. The known impact is limited: an attacker can cause the ImageMagick process to crash or write a single zero byte into freed memory. Based on the published CVSS vector, exploitation requires specific conditions and does not currently indicate confidentiality or integrity compromise beyond low availability impact.

Why it matters to the business

Systems that automatically process user-supplied images, documents, archives, or converted media with ImageMagick may be vulnerable to denial-of-service if a malicious PDB file is submitted. The most likely consequence is interruption of image conversion, thumbnail generation, document preview, or media-processing jobs. There is no current evidence of active exploitation, ransomware use, or broad weaponization, and the EPSS score is low, but internet-facing upload and conversion workflows should still be patched to prevent avoidable service instability.

How an attack unfolds

An attacker prepares a malformed PDB image designed to drive the ImageMagick PDB decoder into an allocation-failure path where a freed object is later reused. The attacker then causes a vulnerable ImageMagick instance to process the file, typically by uploading it to an application that performs server-side image conversion, submitting it to a document-processing workflow, or sending it to an automated pipeline that invokes ImageMagick utilities or libraries. If the vulnerable decoder path is reached, ImageMagick may dereference a stale pointer, resulting in a process crash or a constrained memory write of a single zero byte to freed memory. Reliable exploitation is expected to be difficult and condition-dependent; the practical attacker objective is most likely denial-of-service against image-processing workers rather than code execution.

How to fix it

Upgrade ImageMagick to version 7.1.2-15 or later wherever ImageMagick is installed directly or bundled into applications, containers, serverless functions, desktop tools, or CI/CD image-processing jobs. If immediate upgrade is not possible, reduce exposure by disabling or blocking PDB decoding where not required, rejecting PDB files at upload and ingestion points, enforcing strict file-type allowlists, isolating ImageMagick processing in low-privilege sandboxes or containers, and applying CPU, memory, file-size, and timeout limits to conversion jobs. Ensure downstream packages, container images, and application dependencies that embed or call ImageMagick are rebuilt against the fixed version.

How to confirm the fix worked

Confirm that all ImageMagick binaries and libraries report version 7.1.2-15 or later using commands such as `magick -version`, `convert -version`, package-manager queries, container image scans, and software composition analysis. Validate that applications invoking ImageMagick use the updated binary or linked library rather than an older bundled copy. Test upload and conversion controls to ensure PDB files are either safely rejected or processed only by a fixed version. Review container base images, language bindings, desktop packages, and third-party tools that may include ImageMagick indirectly.

Typical attack path

1. Identify an application, service, or workflow that accepts image-like files and processes them with ImageMagick.
2. Craft or obtain a malicious PDB file that triggers the vulnerable PDB decoder allocation-failure path.
3. Submit the file through an upload, API, message queue, archive, email attachment, or batch-processing path that invokes ImageMagick.
4. Cause ImageMagick to parse the PDB file using a vulnerable version before 7.1.2-15.
5. Trigger a crash or unstable behavior in the image-processing process, potentially disrupting conversion or preview generation.

How to detect it

To determine whether this issue may already have been exploited, review application logs, upload logs, API gateway logs, object-storage access logs, message-queue records, and image-processing worker logs for unexpected PDB files followed by ImageMagick failures or worker restarts. Correlate file submissions with process crashes, segmentation faults, container restarts, out-of-memory events, failed conversion messages, and repeated retries. Examine crash dumps, core files, systemd journal entries, Kubernetes events, container runtime logs, EDR telemetry, and application error monitoring for ImageMagick processes such as `magick`, `convert`, or services linked to `libMagickCore` failing while parsing PDB content. Because no public exploitation campaign or specific actor activity is currently associated with this vulnerability, detection should focus on behavioral evidence: malicious or unusual PDB ingestion, decoder crashes, abnormal memory errors, and denial-of-service patterns against media-processing components.

• magick
• convert
• libMagickCore
• coders/pdb.c
• PDB
• AddressSanitizer: heap-use-after-free
• heap-use-after-free
• use-after-free
• Segmentation fault
• core dumped
• SIGSEGV
• ImageMagick
• MagickCore
• MagickWand
• .pdb

What your security team should do

• Inventory all systems, containers, applications, and build pipelines that use ImageMagick or ImageMagick-backed libraries.
• Prioritize patching internet-facing upload, preview, thumbnailing, document-conversion, and media-processing services to ImageMagick 7.1.2-15 or later.
• Temporarily block or disable PDB file processing if the format is not business-critical.
• Apply sandboxing, low-privilege execution, memory limits, file-size limits, and job timeouts to all server-side image conversion workflows.
• Search recent logs for ImageMagick crashes, repeated failed conversions, or unexpected PDB processing activity.
• Monitor vendor packages and container base images to ensure fixed ImageMagick builds are actually deployed in runtime environments.