Junglewise Threat Intelligence

CVE-2026-56378: ImageMagick heap out-of-bounds read in PCD coder

CVE-2026-56378 · Severity: low · CVSS 3.7 · Published 2026-06-21

Technologies: ImageMagick, Magick.NET-Q16-OpenMP-arm64 (NuGet), Magick.NET-Q16-AnyCPU (NuGet), Magick.NET-Q16-HDRI-AnyCPU (NuGet), Magick.NET-Q8-x86 (NuGet), Magick.NET-Q8-AnyCPU (NuGet), Magick.NET-Q16-arm64 (NuGet), Magick.NET-Q16-OpenMP-x64 (NuGet), Magick.NET-Q16-HDRI-OpenMP-x64 (NuGet), Magick.NET-Q16-OpenMP-x86 (NuGet), Magick.NET-Q16-HDRI-arm64 (NuGet), Magick.NET-Q16-HDRI-x86 (NuGet), Magick.NET-Q16-HDRI-x64 (NuGet), Magick.NET-Q8-OpenMP-arm64 (NuGet), Magick.NET-Q8-OpenMP-x64 (NuGet), Magick.NET-Q16-x64 (NuGet), Magick.NET-Q8-arm64 (NuGet), Magick.NET-Q8-x64 (NuGet), Magick.NET-Q16-x86 (NuGet), Magick.NET-Q16-HDRI-OpenMP-arm64 (NuGet). Vendors: ImageMagick, NuGet.

Executive brief

ImageMagick is a widely used software suite for displaying, converting, and editing image files. A vulnerability in its PCD image format decoder allows a specially crafted file to cause a minor memory error during processing. This could lead to a temporary service crash or the unintended exposure of a small amount of internal memory data.

Technical details

A heap out-of-bounds read vulnerability (CWE-125) exists in the PCD (Photo CD) coder within ImageMagick's DecodeImage loop. The flaw is triggered when the decoder processes a maliciously crafted PCD file, leading to a one-byte read beyond the allocated heap buffer. While the attack complexity is high and the impact is limited, it can result in a denial of service (crash) or the disclosure of a single adjacent byte from the heap. The issue is addressed in versions 7.1.2-15 and 6.9.13-40.

Affected products

  • ImageMagick ImageMagick < 7.1.2-15, < 6.9.13-40

Timeline

  • 2026-02-23: advisory: Initial GitHub security advisory published
  • 2026-06-21: disclosed: NVD publication date

References

Related threats