CVE-2026-56362

A heap-buffer-overflow read in ImageMagick's OpenPixelCache occurs when image channel metadata updates before memory allocation. Attackers can trigger this via memory and disk allocation failures to disclose sensitive information.

This vulnerability in ImageMagick is rated as Low impact. A heap-buffer-overflow read can occur in the GetPixelIndex function if OpenPixelCache updates image channel metadata before memory allocation, and both memory and disk allocation subsequently fail. Exploitation requires an attacker to trigger these specific resource exhaustion conditions, which limits the practical attack surface and reduces the overall risk of information disclosure on standard Red Hat deployments.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Isolate ImageMagick tasks by running them inside unprivileged containers (such as Podman) with strict SELinux confinement. Alternatively, sanitize untrusted files using an intermediate script to strip complex metadata before passing them to ImageMagick.