Executive brief
ImageMagick is a widely used software suite for displaying, converting, and editing image files. A vulnerability in its PCD image format decoder allows a specially crafted file to cause a minor memory error during processing. This could lead to a temporary service crash or the unintended exposure of a small amount of internal memory data.
Technical details
A heap out-of-bounds read vulnerability (CWE-125) exists in the PCD (Photo CD) coder within ImageMagick's DecodeImage loop. The flaw is triggered when the decoder processes a maliciously crafted PCD file, leading to a one-byte read beyond the allocated heap buffer. While the attack complexity is high and the impact is limited, it can result in a denial of service (crash) or the disclosure of a single adjacent byte from the heap. The issue is addressed in versions 7.1.2-15 and 6.9.13-40.
Affected products
- ImageMagick ImageMagick < 7.1.2-15, < 6.9.13-40
Timeline
- 2026-02-23: advisory: Initial GitHub security advisory published
- 2026-06-21: disclosed: NVD publication date