CVE-2026-56372 is a low severity (CVSS 3.3) heap out-of-bounds read in ImageMagick's magnify operation, triggered by an unrecognized magnify:method value. ImageMagick 7.1.2-19 fixes it. Upgrade to that release or later, and rebuild images that bundle the library.
What's affected
The ImageMagick advisory (GHSA-8vfj-q2cp-5m5j) says versions before 7.1.2-19 are affected and 7.1.2-19 is patched. The advisory lists no separate 6.x fix.
The flaw is an out-of-bounds read in the magnify operation when the magnify:method setting has a value ImageMagick does not recognize. The effect named is a possible exposure of memory contents or a denial of service.
The CVSS vector is AV:L/AC:L/PR:N/UI:R, which means local access and a user action, with only low availability impact. That is why the severity is low.
How to check if you're exposed
Check the installed version.
magick -version
- Anything on the 7.x branch below 7.1.2-19 is affected. The advisory says nothing about 6.x, so check it before assuming either way.
- Search your code and scripts for use of the magnify operation or the magnify:method setting. Applications that never use it are unlikely to reach the flaw.
- Check container images and packages that bundle ImageMagick.
Run the free in-browser dependency scan at https://gold.safeguard.sh/scan against your manifest or lockfile. It lists vulnerable packages without installing anything.
What to do now
- Upgrade ImageMagick to 7.1.2-19 or later.
- Rebuild and redeploy container images that bundle it.
- Search for use of the magnify operation in your code, and confirm the method value is not taken from user input.
- Run image conversions for untrusted input in a sandboxed worker with resource limits.
Why it matters
The record lists CWE-122, heap based buffer overflow, although the advisory describes the effect as a read past the end of a buffer. Either way the code uses a setting value to decide what to do, and it does not handle a value outside the list it expects.
Input that is not on the expected list needs a defined, safe path: reject it or fall back to a default. Bugs of this kind are usually found by fuzzing, and they are cheap to fix once seen. The record is not in CISA's Known Exploited Vulnerabilities catalog. For most teams the right action is a routine library upgrade.
Quick check
Is this a remote attack?
The CVSS vector lists a local attack with user interaction. A service that passes untrusted setting values to ImageMagick could still be reachable, so check how your code calls it.
Sources
Last reviewed: 19 October 2026.
