Executive brief
ImageMagick is a widely used software suite for displaying, converting, and editing image files. A vulnerability in how it handles large Photoshop (PSB) files on 32-bit systems could allow an attacker to crash the application or potentially access sensitive information from the computer's memory. This occurs when the software processes a specially crafted image file, which could impact services that automatically process user-uploaded images.
Technical details
An integer overflow vulnerability exists in the ReadPSDChannelRLE function within coders/psd.c of ImageMagick. The flaw is triggered during the RLE decoding of PSB (PSD version 2) files specifically on 32-bit architectures. An attacker can exploit this by providing a crafted PSB file, leading to a heap-based out-of-bounds read. This can result in a denial-of-service (crash) or the disclosure of sensitive memory contents. The issue is addressed in versions 7.1.2-15 and 6.9.13-40.
Affected products
- ImageMagick ImageMagick < 7.1.2-15, < 6.9.13-40 (32-bit builds)
Timeline
- 2026-02-23: advisory: GitHub Security Advisory published
- 2026-06-21: disclosed: NVD publication date