Copyright © 2012 Red Hat, Inc. All rights reserved. Low 2026-07-08T13:49:04 ImageMagick: Magick.NET-Q16-AnyCPU: Magick.NET-Q16-HDRI-AnyCPU: Magick.NET-Q16-HDRI-OpenMP-arm64: Magick.NET-Q16-HDRI-OpenMP-x64: Magick.NET-Q16-HDRI-arm64: Magick.NET-Q16-HDRI-x64: Magick.NET-Q16-HDRI-x86: Magick.NET-Q16-OpenMP-arm64: Magick.NET-Q16-OpenMP-x64: Magick.NET-Q16-OpenMP-x86: Magick.NET-Q16-arm64: Magick.NET-Q16-x64: Magick.NET-Q16-x86: Magick.NET-Q8-AnyCPU: Magick.NET-Q8-OpenMP-arm64: Magick.NET-Q8-OpenMP-x64: Magick.NET-Q8-arm64: Magick.NET-Q8-x64: Magick.NET-Q8-x86: ImageMagick: Information disclosure via heap-buffer-overflow read 3.3 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:L CWE-125

ImageMagick before 7.1.2-15 contains a heap-buffer-overflow read vulnerability in GetPixelIndex caused by OpenPixelCache updating image channel metadata before pixel cache memory allocation. Attackers can trigger memory and disk allocation failures to cause a heap-buffer-overflow read affecting any writer calling GetPixelIndex.

A heap-buffer-overflow read in ImageMagick's OpenPixelCache occurs when image channel metadata updates before memory allocation. Attackers can trigger this via memory and disk allocation failures to disclose sensitive information.

This vulnerability in ImageMagick is rated as Low impact. A heap-buffer-overflow read can occur in the `GetPixelIndex` function if `OpenPixelCache` updates image channel metadata before memory allocation, and both memory and disk allocation subsequently fail. Exploitation requires an attacker to trigger these specific resource exhaustion conditions, which limits the practical attack surface and reduces the overall risk of information disclosure on standard Red Hat deployments. Isolate ImageMagick tasks by running them inside unprivileged containers (such as Podman) with strict SELinux confinement. Alternatively, sanitize untrusted files using an intermediate script to strip complex metadata before passing them to ImageMagick. Red Hat Enterprise Linux 6 Out of support scope ImageMagick Red Hat Enterprise Linux 7 Out of support scope ImageMagick https://www.cve.org/CVERecord?id=CVE-2026-56362 https://nvd.nist.gov/vuln/detail/CVE-2026-56362 https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-gq5v-qf8q-fp77 https://www.vulncheck.com/advisories/imagemagick-heap-buffer-overflow-read-in-getpixelindex-via-openpixelcache-metadata-desynchronization