GHSA-jmqv-2mx7-544hMedium· 3.7▾ SunlitDuplicate Advisory: ImageMagick: Malicious PCD files trigger 1‑byte heap Out-of-bounds Read and DoS
▾ Sunlit zone — Low / medium · no exploitation signal
impact 20.4 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via GHSA
Last analysed / modified upstream
This advisory has been withdrawn because it is a duplicate of GHSA-wgxp-q8xq-wpp9. This link is maintained to preserve external references.
ImageMagick before 7.1.2-15 (and 6.x before 6.9.13-40) contains a heap out-of-bounds read in the PCD coder's DecodeImage loop. A crafted PCD file can trigger a one-byte heap out-of-bounds read during image decoding, resulting in denial of service and potential disclosure of an adjacent heap byte.
Magick.NET-Q16-AnyCPU < 14.10.3Upgrade to a patched release:
Magick.NET-Q16-AnyCPU 14.10.3Connected by shared product, vendor, weakness, or advisory.
CVE-2026-56378Medium· 3.7ImageMagick: Malicious PCD files trigger 1‑byte heap Out-of-bounds Read and DoS
CVE-2026-56367Low· 3.7ImageMagick: Integer Overflow in PSB (PSD v2) RLE decoding path causes heap Out of Bounds reads for 32-bit builds
GHSA-hwf3-r46v-5ggxLow· 2.9ImageMagick: Information Disclosure when printing profiles with debug enabled
GHSA-rg39-4fm5-hrp2Medium· 3.7Duplicate Advisory: ImageMagick: Integer Overflow in PSB (PSD v2) RLE decoding path causes heap Out of Bounds reads for 32-bit builds
GHSA-8g9f-ccmr-vfvgMedium· 3.7Duplicate Advisory: ImageMagick has a possible heap Use After Free vulnerability in its meta coder
GHSA-98gv-6gmj-cm6mLowDuplicate Advisory: ImageMagick: Memory leak in coders/txt.c without freetype