What is GHSA-8g9f-ccmr-vfvg?

GHSA-8g9f-ccmr-vfvg is a security advisory published by GitHub Security Advisories with Medium severity. Duplicate Advisory: ImageMagick has a possible heap Use After Free vulnerability in its meta coder

Why does GHSA-8g9f-ccmr-vfvg have no CVE ID yet?

GitHub Security Advisories published this advisory directly to customers before NVD assigned a CVE ID. This is the embargo-window disclosure pattern — vendors notify customers on day 0; NVD's public record follows days to weeks later.

What is the CVSS v3 score of GHSA-8g9f-ccmr-vfvg?

GHSA-8g9f-ccmr-vfvg has a CVSS v3 base score of 3.7, published by GitHub Security Advisories.

Which products are affected by GHSA-8g9f-ccmr-vfvg?

GHSA-8g9f-ccmr-vfvg affects 1 product, including: nuget/Magick.NET-Q16-AnyCPU:\u003c 14.10.3.

⚠ Withdrawn by GitHub Security Advisories

Withdrawn: September 24, 2026

GHSA-8g9f-ccmr-vfvgMediumCVSS 3.7Disclosed before NVD

Duplicate Advisory: ImageMagick has a possible heap Use After Free vulnerability in its meta coder

Vendor

GitHub Security Advisories

Published

June 23, 2026

Last Modified

September 24, 2026

📋 Description

Duplicate Advisory

This advisory has been withdrawn because it is a duplicate of GHSA-2gq3-ww97-wfjm. This link is maintained to preserve external references.

Original Description

ImageMagick before 7.1.2-15 and 6.9.13-40 contains a heap use-after-free in the meta coder: when memory allocation fails, a single byte is written to a stale pointer. Remote attackers can trigger it by processing specially crafted image files, causing a denial of service.

🎯 Affected products1

nuget/Magick.NET-Q16-AnyCPU:< 14.10.3

🔗 References (4)

https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-2gq3-ww97-wfjm
https://nvd.nist.gov/vuln/detail/CVE-2026-56376
https://www.vulncheck.com/advisories/imagemagick-heap-use-after-free-in-meta-coder
https://github.com/advisories/GHSA-8g9f-ccmr-vfvg