ImageMagick before 7.1.2-13 contains a memory leak vulnerability in LoadOpenCLDeviceBenchmark() function when parsing malformed OpenCL device profile XML files with unclosed device elements. Attackers with write access to the OpenCL cache directory can place malicious XML files to exhaust memory and cause denial of service.
Fix
Patch, vendor advisory and mitigation references on NVD 4
- https://github.com/ImageMagick/ImageMagick/commit/a52c1b402be08ef8ae193f28ac5b2e120f2fa26f Patch
- https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-qp59-x883-77qv Exploit, Vendor Advisory
- https://www.vulncheck.com/advisories/imagemagick-memory-leak-in-loadopencldevicebenchmark-via-malformed-xml Patch, Third Party Advisory
- https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-qp59-x883-77qv Exploit, Vendor Advisory
Every line above is quoted from NVD, CISA, Microsoft, the vendor's own advisory or DISA; nothing is generated.
Change history 1
- First seenCVSS 1.8 · imagemagickNVD modified 2026-10-25 17:10
Affected (CPE criteria) 1
cpe:2.3:a:imagemagick:imagemagick:*:*:*:*:*:*:*:*
References 4
- https://github.com/ImageMagick/ImageMagick/commit/a52c1b402be08ef8ae193f28ac5b2e120f2fa26f Patch
- https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-qp59-x883-77qv Exploit, Vendor Advisory
- https://www.vulncheck.com/advisories/imagemagick-memory-leak-in-loadopencldevicebenchmark-via-malformed-xml Patch, Third Party Advisory
- https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-qp59-x883-77qv Exploit, Vendor Advisory