Executive brief
ImageMagick, a widely used tool for editing and processing digital images, contains a vulnerability in how it handles Photoshop (PSD) files. An attacker could provide a specially crafted image that bypasses security limits designed to restrict resource usage. This could lead to excessive memory or processing consumption, potentially slowing down or crashing services that automatically process user-uploaded images.
Technical details
A resource policy bypass exists in ImageMagick's PSD decoder due to a missing check against the 'list-length' resource policy. By providing a specially crafted PSD image, a remote attacker can bypass intended restrictions on the number of elements processed, leading to uncontrolled resource consumption (CWE-400/CWE-770). While other security limits remain in place, this flaw can impact availability by exhausting system resources during image decoding. The issue is fixed in versions 6.9.13-47 and 7.1.2-22.
Affected products
- ImageMagick ImageMagick < 6.9.13-47, < 7.1.2-22
Timeline
- 2026-05-16: advisory: GitHub Security Advisory published
- 2026-06-10: disclosed: NVD publication date