EUVD-2026-38174
GHSA-jmqv-2mx7-544h
Severity by source
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-delivered via crafted PCD file; AC:H reflects specific format prerequisites; A:L captures DoS impact that the provided CVSS 4.0 vector incorrectly omits (VA:N).
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
3DescriptionCVE.org
ImageMagick before 7.1.2-15 (and 6.x before 6.9.13-40) contains a heap out-of-bounds read in the PCD coder's DecodeImage loop. A crafted PCD file can trigger a one-byte heap out-of-bounds read during image decoding, resulting in denial of service and potential disclosure of an adjacent heap byte.
AnalysisAI
Heap out-of-bounds read in ImageMagick's PCD image decoder (versions prior to 7.1.2-15 and 6.9.13-40) allows unauthenticated network-reachable attackers to cause denial of service and disclose a single adjacent heap byte by supplying a crafted PCD file to an image-processing endpoint. The vulnerability is rooted in the PCD coder's DecodeImage loop and requires high attack complexity (AC:H) with specific attack prerequisites (AT:P), meaning the target application must actively process attacker-supplied PCD files. No public exploit code has been identified and this vulnerability does not appear in the CISA KEV catalog at time of analysis, though .NET bindings via Magick.NET NuGet packages are also affected and carry a separate fix version.
Technical ContextAI
The vulnerable component is ImageMagick's PCD (Kodak Photo CD) image format coder, specifically the DecodeImage function which parses the legacy PCD raster format. CWE-125 (Out-of-bounds Read) identifies the root cause class: the decoder performs a one-byte read beyond the bounds of an allocated heap buffer during the image decode loop - a classic boundary-check failure in a memory-unsafe image parser. Both major release lines are affected: the 7.x branch (cpe:2.3:a:imagemagick:imagemagick:*:*:*:*:*:*:*:* for versions before 7.1.2-15) and the 6.x branch (same CPE pattern, versions before 6.9.13-40). Because Magick.NET - the .NET language binding for ImageMagick distributed via NuGet - wraps the native ImageMagick library, it transitively inherits this vulnerability, affecting packages Magick.NET-Q16-AnyCPU, Magick.NET-Q16-HDRI-AnyCPU, Magick.NET-Q16-HDRI-OpenMP-arm64, and Magick.NET-Q16-HDRI-OpenMP-x64 prior to version 14.10.3.
RemediationAI
The primary fix is to upgrade ImageMagick to version 7.1.2-15 or later (7.x branch) or 6.9.13-40 or later (6.x branch), as confirmed by vendor advisory GHSA-wgxp-q8xq-wpp9 and the upstream patch commit at https://github.com/ImageMagick/ImageMagick/commit/436e5d2589e3c0adc10d9aa189e81d5d088d8207. For .NET applications, upgrade affected Magick.NET NuGet packages (Magick.NET-Q16-AnyCPU, Magick.NET-Q16-HDRI-AnyCPU, Magick.NET-Q16-HDRI-OpenMP-arm64, Magick.NET-Q16-HDRI-OpenMP-x64) to version 14.10.3 or later. Where immediate patching is not feasible, operators should disable the PCD coder in ImageMagick's policy.xml by adding the directive '<policy domain="coder" rights="none" pattern="PCD" />', which fully eliminates the attack surface at the cost of losing PCD image format support - an acceptable trade-off given the format's rarity in modern workflows. As a shallow complementary control, file upload endpoints can reject .pcd extensions, though this should not substitute for policy.xml hardening or patching, as content-type checks are bypassable.
More in Imagemagick
View allThe (1) EPHEMERAL, (2) HTTPS, (3) MVG, (4) MSL, (5) TEXT, (6) SHOW, (7) WIN, and (8) PLT coders in ImageMagick before 6.
The (1) HTTP and (2) FTP coders in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allow remote attackers to conduct
The EPHEMERAL coder in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allows remote attackers to delete arbitrary fi
ReadGIFImage in coders/gif.c in ImageMagick 7.0.6-1 and GraphicsMagick 1.3.26 leaves the palette uninitialized when proc
Integer overflow in MagickCore/profile.c in ImageMagick before 7.0.2-1 allows remote attackers to cause a denial of serv
The LABEL coder in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allows remote attackers to read arbitrary files vi
The OpenBlob function in blob.c in GraphicsMagick before 1.3.24 and ImageMagick allows remote attackers to execute arbit
The DCM reader in ImageMagick before 6.9.4-5 and 7.x before 7.0.1-7 allows remote attackers to have unspecified impact b
The ReadDCMImage function in DCM reader in ImageMagick before 6.9.4-5 and 7.x before 7.0.1-7 allows remote attackers to
The DCM reader in ImageMagick before 6.9.4-5 and 7.x before 7.0.1-7 allows remote attackers to have unspecified impact b
ImageMagick 7.0.6-5 has a memory leak vulnerability in ReadWEBPImage in coders/webp.c because memory is not freed in cer
Heap buffer overflow in ImageMagick's XBM image decoder (ReadXBMImage) lets remote attackers write attacker-controlled d
Same weakness CWE-125 – Out-of-bounds Read
View allSame technique Buffer Overflow
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today