GHSA-gq5v-qf8q-fp77

ghsaUSosv

ImageMagick: Heap-based Buffer Overflow in GetPixelIndex due to metadata-cache desynchronization

view advisory published 2026-02-25Licence: CC-BY-4.0

`OpenPixelCache` updates image channel metadata **before** attempting pixel cache memory allocation. When both memory and disk allocation fail a heap-buffer-overflow read in occurs in any writer that calls `GetPixelIndex`.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2026-56362US	medium4.2	0.19% (8th)	—	2026-07-08
ImageMagick before 7.1.2-15 contains a heap-buffer-overflow read vulnerability in GetPixelIndex caused by OpenPixelCache updating image channel metadata before pixel cache memory a…

references

External citations — patches, advisories, analysis.

https://github.com/ImageMagick/ImageMagickPACKAGE
https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-gq5v-qf8q-fp77WEB
https://github.com/dlemstra/Magick.NET/releases/tag/14.10.3WEB

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan