CVE-2026-56378

EUVD-2026-38174
ImageMagick before 7.1.2-15 (and 6.x before 6.9.13-40) contains a heap out-of-bounds read in the PCD coder's DecodeImage loop. A crafted PCD file can trigger a one-byte heap out-of-bounds read during image decoding, resulting in denial of service and potential disclosure of an adjacent heap byte.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
3.7 LOW
NETWORK
HIGH
NONE
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: 12%
Affected Products (NVD)
VendorProductVersion
imagemagickimagemagick
6.9.0-0 ≤
𝑥
< 6.9.13-40
imagemagickimagemagick
7.1.2-0 ≤
𝑥
< 7.1.2-15
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
imagemagick
bookworm
vulnerable
bookworm (security)
8:6.9.11.60+dfsg-1.6+deb12u13
fixed
bullseye
vulnerable
bullseye (security)
8:6.9.11.60+dfsg-1.3+deb11u16
fixed
forky
8:7.1.2.27+dfsg1-1
fixed
sid
8:7.1.2.27+dfsg1-1
fixed
trixie
vulnerable
trixie (security)
8:7.1.1.43+dfsg1-1+deb13u11
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
imagemagick
bionic
needs-triage
focal
needs-triage
jammy
needs-triage
noble
needs-triage
questing
ignored
resolute
not-affected
trusty
needs-triage
xenial
needs-triage
Amazon Linux logo
Amazon Linux Releases
Amazon Package
Release
ImageMagick
Amazon Linux 2
0:6.9.10.97-1.amzn2.0.31
fixed
Amazon Linux 2023
1:6.9.13.40-1.amzn2023.0.1
fixed
ImageMagick-c++
Amazon Linux 2
0:6.9.10.97-1.amzn2.0.31
fixed
Amazon Linux 2023
1:6.9.13.40-1.amzn2023.0.1
fixed
ImageMagick-c++-debuginfo
Amazon Linux 2023
1:6.9.13.40-1.amzn2023.0.1
fixed
ImageMagick-c++-devel
Amazon Linux 2
0:6.9.10.97-1.amzn2.0.31
fixed
Amazon Linux 2023
1:6.9.13.40-1.amzn2023.0.1
fixed
ImageMagick-debuginfo
Amazon Linux 2
0:6.9.10.97-1.amzn2.0.31
fixed
Amazon Linux 2023
1:6.9.13.40-1.amzn2023.0.1
fixed
ImageMagick-debugsource
Amazon Linux 2023
1:6.9.13.40-1.amzn2023.0.1
fixed
ImageMagick-devel
Amazon Linux 2
0:6.9.10.97-1.amzn2.0.31
fixed
Amazon Linux 2023
1:6.9.13.40-1.amzn2023.0.1
fixed
ImageMagick-doc
Amazon Linux 2
0:6.9.10.97-1.amzn2.0.31
fixed
Amazon Linux 2023
1:6.9.13.40-1.amzn2023.0.1
fixed
ImageMagick-libs
Amazon Linux 2023
1:6.9.13.40-1.amzn2023.0.1
fixed
ImageMagick-libs-debuginfo
Amazon Linux 2023
1:6.9.13.40-1.amzn2023.0.1
fixed
ImageMagick-perl
Amazon Linux 2
0:6.9.10.97-1.amzn2.0.31
fixed
Amazon Linux 2023
1:6.9.13.40-1.amzn2023.0.1
fixed
ImageMagick-perl-debuginfo
Amazon Linux 2023
1:6.9.13.40-1.amzn2023.0.1
fixed
Common Weakness Enumeration
References
https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-wgxp-q8xq-wpp9
https://www.vulncheck.com/advisories/imagemagick-heap-out-of-bounds-read-in-pcd-decoder