{"id":"GHSA-jmqv-2mx7-544h","title":"Duplicate Advisory: ImageMagick: Malicious PCD files trigger 1‑byte heap Out-of-bounds Read and DoS","summary":"Duplicate Advisory: ImageMagick: Malicious PCD files trigger 1‑byte heap Out-of-bounds Read and DoS","severity":"medium","cvss":3.7,"cwe":["CWE-125"],"vendor":"Magick","product":"Magick.NET-Q16-AnyCPU","ecosystem":"nuget","affected":["Magick.NET-Q16-AnyCPU < 14.10.3"],"patched":["Magick.NET-Q16-AnyCPU 14.10.3"],"published":"2026-06-21","updated":"2026-11-06","sourceUpdated":"2026-11-06T18:06:08Z","source":"GHSA","sourceUrl":"https://github.com/advisories/GHSA-jmqv-2mx7-544h","references":[{"url":"https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-wgxp-q8xq-wpp9"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-56378"},{"url":"https://www.vulncheck.com/advisories/imagemagick-heap-out-of-bounds-read-in-pcd-decoder"},{"url":"https://github.com/advisories/GHSA-jmqv-2mx7-544h"}],"tags":["ghsa","nuget"],"ingestedAt":"2026-11-06T19:01:36.619Z","slug":"GHSA-jmqv-2mx7-544h","body":"## Overview\n\n### Duplicate Advisory\nThis advisory has been withdrawn because it is a duplicate of GHSA-wgxp-q8xq-wpp9. This link is maintained to preserve external references.\n\n### Original Description\nImageMagick before 7.1.2-15 (and 6.x before 6.9.13-40) contains a heap out-of-bounds read in the PCD coder's DecodeImage loop. A crafted PCD file can trigger a one-byte heap out-of-bounds read during image decoding, resulting in denial of service and potential disclosure of an adjacent heap byte.\n\n## Affected packages\n\n- `Magick.NET-Q16-AnyCPU < 14.10.3`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `Magick.NET-Q16-AnyCPU 14.10.3`","depth":"sunlit","depthScore":20,"depthScoreParts":{"impact":20.4,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}