{"id":"CVE-2026-56367","kind":"vulnerability","aliases":["CVE-2026-56367","GHSA-273h-m46v-96q4"],"related":[],"title":"ImageMagick: Integer Overflow in PSB (PSD v2) RLE decoding path causes heap Out of Bounds reads for 32-bit builds","description":"An integer overflow in the PSB (PSD v2) RLE decoding path causes a heap out-of-bounds read on 32-bit builds. This can lead to information disclosure or a crash when processing crafted PSB files.\n\n```\n=================================================================\n==3298==ERROR: AddressSanitizer: heap-buffer-overflow on address 0xf512eb00 at pc 0xf76760b5 bp 0xffc1dfb8 sp 0xffc1dfa8\nREAD of size 8 at 0xf512eb00 thread T0\n    #0 0xf76760b4 in ReadPSDChannelRLE coders/psd.c:1141\n```","summary":"A flaw in ImageMagick's PSB (PSD v2) RLE decoder is an integer overflow that causes a heap out-of-bounds read on 32-bit builds. An attacker who supplies a crafted PSB file can leak memory contents or crash the process.","severity":"critical","cvss":9.1,"epss":0.00236,"exploited":false,"exploited_at":null,"products":[{"name":"Magick.NET-Q16-AnyCPU","fixed":["14.10.3"],"affected":"< 14.10.3","ecosystem":"nuget"},{"name":"Magick.NET-Q16-HDRI-AnyCPU","fixed":["14.10.3"],"affected":"< 14.10.3","ecosystem":"nuget"},{"name":"Magick.NET-Q16-HDRI-OpenMP-arm64","fixed":["14.10.3"],"affected":"< 14.10.3","ecosystem":"nuget"},{"name":"Magick.NET-Q16-HDRI-OpenMP-x64","fixed":["14.10.3"],"affected":"< 14.10.3","ecosystem":"nuget"},{"name":"Magick.NET-Q16-HDRI-arm64","fixed":["14.10.3"],"affected":"< 14.10.3","ecosystem":"nuget"},{"name":"Magick.NET-Q16-HDRI-x64","fixed":["14.10.3"],"affected":"< 14.10.3","ecosystem":"nuget"},{"name":"Magick.NET-Q16-HDRI-x86","fixed":["14.10.3"],"affected":"< 14.10.3","ecosystem":"nuget"},{"name":"Magick.NET-Q16-OpenMP-arm64","fixed":["14.10.3"],"affected":"< 14.10.3","ecosystem":"nuget"},{"name":"Magick.NET-Q16-OpenMP-x64","fixed":["14.10.3"],"affected":"< 14.10.3","ecosystem":"nuget"},{"name":"Magick.NET-Q16-OpenMP-x86","fixed":["14.10.3"],"affected":"< 14.10.3","ecosystem":"nuget"},{"name":"Magick.NET-Q16-arm64","fixed":["14.10.3"],"affected":"< 14.10.3","ecosystem":"nuget"},{"name":"Magick.NET-Q16-x64","fixed":["14.10.3"],"affected":"< 14.10.3","ecosystem":"nuget"},{"name":"Magick.NET-Q16-x86","fixed":["14.10.3"],"affected":"< 14.10.3","ecosystem":"nuget"},{"name":"Magick.NET-Q8-AnyCPU","fixed":["14.10.3"],"affected":"< 14.10.3","ecosystem":"nuget"},{"name":"Magick.NET-Q8-OpenMP-arm64","fixed":["14.10.3"],"affected":"< 14.10.3","ecosystem":"nuget"},{"name":"Magick.NET-Q8-OpenMP-x64","fixed":["14.10.3"],"affected":"< 14.10.3","ecosystem":"nuget"},{"name":"Magick.NET-Q8-arm64","fixed":["14.10.3"],"affected":"< 14.10.3","ecosystem":"nuget"},{"name":"Magick.NET-Q8-x64","fixed":["14.10.3"],"affected":"< 14.10.3","ecosystem":"nuget"},{"name":"Magick.NET-Q8-x86","fixed":["14.10.3"],"affected":"< 14.10.3","ecosystem":"nuget"},{"name":"imagemagick","fixed":["6.9.13-40"],"affected":">= 6.9.0-0, < 6.9.13-40","ecosystem":"vendor"},{"name":"imagemagick","fixed":["7.1.2-15"],"affected":">= 7.1.2-0, < 7.1.2-15","ecosystem":"vendor"}],"ecosystems":["nuget","vendor"],"tags":["cwe-125","cwe-190","dotnet","image-processing","imagemagick","magick.net","package"],"not_affected_if":["64-bit-only-builds","no-untrusted-psd-input"],"how_to_check":"- Check the installed Magick.NET package version in your project file or with `dotnet list package`, and compare it against `14.10.3`.\n- Look for 32-bit builds of the Q16 packages (x86 variants) that process untrusted PSB files.","fix":"- Magick.NET-Q16 packages (all variants): `14.10.3`","status":"open","published_at":"2026-02-25T15:20:15+00:00","first_seen_at":"2026-11-03T17:41:47+00:00","triaged_at":"2026-11-03T17:42:45+00:00","updated_at":"2026-11-03T17:52:24+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-03T17:42:45Z","model":"claude-haiku-5-5","output":{"fix":"- Magick.NET-Q16 packages (all variants): `14.10.3`","reach":"unknown","title":"ImageMagick: crafted PSB file over-reads heap memory on 32-bit builds","impact":"low","summary":"A flaw in ImageMagick's PSB (PSD v2) RLE decoder is an integer overflow that causes a heap out-of-bounds read on 32-bit builds. An attacker who supplies a crafted PSB file can leak memory contents or crash the process.","audience":"developers","category":"package","nicknames":[],"who_cares":["imagemagick","magick.net","dotnet","image-processing"],"confidence":0.7,"fix_status":"available","needs_auth":"no","worst_case":"memory contents leak or the process crashes","analyst_note":"","how_to_check":"- Check the installed Magick.NET package version in your project file or with `dotnet list package`, and compare it against `14.10.3`.\n- Look for 32-bit builds of the Q16 packages (x86 variants) that process untrusted PSB files.","plain_action":"","needs_analyst":false,"not_affected_if":["64-bit-only-builds","no-untrusted-psd-input"],"who_is_affected":"Applications that use Magick.NET to decode PSD/PSB images, especially 32-bit x86 builds processing files from untrusted sources. Projects that never open PSB files or only handle trusted images can likely skip it. unknown for any further detail.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"low"},"cost_usd":0.000756,"input_tokens":4865,"output_tokens":538,"severity_before":"low"},"analyst_status":null,"analyst_note":null,"search":"'-125':124B '-190':126B '-2026':22A,30A '-56367':23A,31A '0':239C '0xf512eb00':223C,236C '0xf76760b4':240C '0xf76760b5':226C '0xffc1dfa8':230C '0xffc1dfb8':228C '1141':244C '273h':26A '32':18A,158B,197C '3298':214C '8':234C '96q4':28A 'address':222C 'addresssanit':216C 'anycpu':35A,40A,98A 'arm64':46A,57A,72A,86A,103A,112A 'attack':162B 'bit':19A,159B,198C 'bound':15A,155B,194C 'bp':227C 'buffer':219C 'build':20A,160B,199C 'caus':11A,149B,188C 'coders/psd.c':243C 'content':172B 'craft':166B,211C 'crash':174B,208C 'cve':21A,29A 'cwe':123B,125B 'decod':9A,143B,186C 'disclosur':205C 'dotnet':127B 'error':215C 'file':168B,213C 'flaw':135B 'ghsa':25A 'ghsa-273h-m46v-96q4':24A 'hdri':39A,44A,50A,56A,61A,66A 'heap':12A,151B,190C,218C 'heap-buffer-overflow':217C 'imag':129B 'image-process':128B 'imagemagick':1A,121A,122A,131B,137B 'inform':204C 'integ':2A,146B,178C 'lead':202C 'leak':170B 'm46v':27A 'magick.net':32A,36A,41A,47A,53A,58A,63A,68A,73A,78A,83A,87A,91A,95A,99A,104A,109A,113A,117A,132B 'memori':171B 'openmp':45A,51A,71A,76A,81A,102A,107A 'out-of-bound':152B,191C 'overflow':3A,147B,179C,220C 'packag':133B 'path':10A,187C 'pc':225C 'process':130B,176B,210C 'psb':5A,139B,167B,182C,212C 'psd':6A,140B,183C 'q16':34A,38A,43A,49A,55A,60A,65A,70A,75A,80A,85A,89A,93A 'q16-anycpu':33A 'q16-arm64':84A 'q16-hdri-anycpu':37A 'q16-hdri-arm64':54A 'q16-hdri-openmp-arm64':42A 'q16-hdri-openmp-x64':48A 'q16-hdri-x64':59A 'q16-hdri-x86':64A 'q16-openmp-arm64':69A 'q16-openmp-x64':74A 'q16-openmp-x86':79A 'q16-x64':88A 'q16-x86':92A 'q8':97A,101A,106A,111A,115A,119A 'q8-anycpu':96A 'q8-arm64':110A 'q8-openmp-arm64':100A 'q8-openmp-x64':105A 'q8-x64':114A 'q8-x86':118A 'read':16A,156B,195C,231C 'readpsdchannelrl':242C 'rle':8A,142B,185C 'size':233C 'sp':229C 'suppli':164B 't0':238C 'thread':237C 'v2':7A,141B,184C 'x64':52A,62A,77A,90A,108A,116A 'x86':67A,82A,94A,120A","nicknames":[],"mitigations":[],"who_affected":"Applications that use Magick.NET to decode PSD/PSB images, especially 32-bit x86 builds processing files from untrusted sources. Projects that never open PSB files or only handle trusted images can likely skip it. unknown for any further detail.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":["imagemagick","magicknetq16anycpu","magicknetq16arm64","magicknetq16hdrianycpu","magicknetq16hdriarm64","magicknetq16hdriopenmparm64","magicknetq16hdriopenmpx64","magicknetq16hdrix64","magicknetq16hdrix86","magicknetq16openmparm64","magicknetq16openmpx64","magicknetq16openmpx86","magicknetq16x64","magicknetq16x86","magicknetq8anycpu","magicknetq8arm64","magicknetq8openmparm64","magicknetq8openmpx64","magicknetq8x64","magicknetq8x86"],"ptokens":["anycpu","arm64","hdri","imagemagick","magick","net","openmp","q16","q8","x64","x86"],"labels":["critical","cwe125","cwe190","dotnet","imagemagick","imageprocessing","magicknet","nuget","package","vendor"],"campaign_type":null,"first_public_at":"2026-02-23T21:21:49+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","cvss_by":"GitHub","poc_count":0,"sources":[{"source":"ghsa","external_id":"GHSA-273h-m46v-96q4","url":"https://github.com/advisories/GHSA-273h-m46v-96q4","severity":"low","published_at":"2026-02-25T15:20:15+00:00","modified_at":"2026-11-03T17:38:15+00:00","first_seen_at":"2026-11-03T17:41:47+00:00","fetched_at":"2026-11-03T17:41:47+00:00","note":null},{"source":"nvd","external_id":"CVE-2026-56367","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-56367","severity":null,"published_at":"2026-06-21T14:16:25+00:00","modified_at":"2026-06-26T13:50:55+00:00","first_seen_at":"2026-11-03T17:52:24+00:00","fetched_at":"2026-11-03T17:52:24+00:00","note":null}],"documents":[{"id":59331,"url":"https://api.github.com/repos/ImageMagick/ImageMagick/security-advisories/GHSA-273h-m46v-96q4","title":"Maintainer's advisory: api.github.com","kind":"vendor","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Maintainer's advisory: api.github.com"},{"id":59332,"url":"https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-273h-m46v-96q4","title":"Maintainer's advisory: github.com","kind":"vendor","source":"ghsa","publisher":"vendor","text":null,"published_at":"2026-02-23T21:21:49+00:00","relation":"advisory","confidence":null,"note":"Maintainer's advisory: github.com"},{"id":59333,"url":"https://github.com/ImageMagick/ImageMagick/commit/5b91ab69af614024255fd93dcc9a62b41fbc435c","title":"Patch: github.com","kind":"other","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":59485,"url":"https://www.vulncheck.com/advisories/imagemagick-heap-out-of-bounds-read-in-psb-rle-decoding","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}