Name: CVE-2026-56365: Missing Release of Memory after Effective Lifetime
Creator: Rapid7
Published: 2026-06-30T00:00:00.000Z
License: https://www.rapid7.com/legal/website-terms-of-use/
Keywords: CVE, CVE-2026-56365, CWE-401, CVSS 5.3, EPSS 0.00284

ImageMagick before 7.1.2-19 contains a memory leak vulnerability in the PNG encoder when writing MNG images. Attackers can trigger the encoder failure condition to exhaust memory resources and cause denial of service.

CVSS Details

CVSS 4.0 Base Score: 6.3 (MEDIUM)
CVSS 4.0 Vector: (CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X)
CVSS 3.1 Base Score: 5.3
CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)

Covered by Rapid7

Product	Vendor Advisory	Solution File	Added	Published
Amazon Linux Ami 2	—	Upgrade ImageMagick-docUpgrade ImageMagick-debuginfoUpgrade ImageMagick-perlUpgrade ImageMagickUpgrade ImageMagick-c++Upgrade ImageMagick-develUpgrade ImageMagick-c++-devel	Oct 19, 2026	Oct 19, 2026
Amazon_linux_2023	—	Upgrade ImageMagick-perlUpgrade ImageMagickUpgrade ImageMagick-docUpgrade ImageMagick-develUpgrade ImageMagick-debugsourceUpgrade ImageMagick-debuginfoUpgrade ImageMagick-libs-debuginfoUpgrade ImageMagick-c++Upgrade ImageMagick-c++-develUpgrade ImageMagick-perl-debuginfoUpgrade ImageMagick-c++-debuginfoUpgrade ImageMagick-libs	Sep 30, 2026	Jun 30, 2026
Debian	—	Upgrade imagemagick	Jul 14, 2026	Jul 14, 2026
Redhat_linux	—	No solution exists	Jul 17, 2026	Jun 30, 2026

Prioritize with Active Threat Intelligence

With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.

Explore Intelligence Hub

MDR Buyer's Guide

Global Threat Landscape Report

Grow your business