--- id: "CVE-2026-56367" kind: "vulnerability" aliases: ["CVE-2026-56367", "GHSA-273h-m46v-96q4"] title: "ImageMagick: Integer Overflow in PSB (PSD v2) RLE decoding path causes heap Out of Bounds reads for 32-bit builds" severity: "critical" cvss: 9.1 epss: 0.00236 exploited: false status: "open" category: "package" products: [{"name": "Magick.NET-Q16-AnyCPU", "fixed": ["14.10.3"], "affected": "< 14.10.3", "ecosystem": "nuget"}, {"name": "Magick.NET-Q16-HDRI-AnyCPU", "fixed": ["14.10.3"], "affected": "< 14.10.3", "ecosystem": "nuget"}, {"name": "Magick.NET-Q16-HDRI-OpenMP-arm64", "fixed": ["14.10.3"], "affected": "< 14.10.3", "ecosystem": "nuget"}, {"name": "Magick.NET-Q16-HDRI-OpenMP-x64", "fixed": ["14.10.3"], "affected": "< 14.10.3", "ecosystem": "nuget"}, {"name": "Magick.NET-Q16-HDRI-arm64", "fixed": ["14.10.3"], "affected": "< 14.10.3", "ecosystem": "nuget"}, {"name": "Magick.NET-Q16-HDRI-x64", "fixed": ["14.10.3"], "affected": "< 14.10.3", "ecosystem": "nuget"}, {"name": "Magick.NET-Q16-HDRI-x86", "fixed": ["14.10.3"], "affected": "< 14.10.3", "ecosystem": "nuget"}, {"name": "Magick.NET-Q16-OpenMP-arm64", "fixed": ["14.10.3"], "affected": "< 14.10.3", "ecosystem": "nuget"}, {"name": "Magick.NET-Q16-OpenMP-x64", "fixed": ["14.10.3"], "affected": "< 14.10.3", "ecosystem": "nuget"}, {"name": "Magick.NET-Q16-OpenMP-x86", "fixed": ["14.10.3"], "affected": "< 14.10.3", "ecosystem": "nuget"}, {"name": "Magick.NET-Q16-arm64", "fixed": ["14.10.3"], "affected": "< 14.10.3", "ecosystem": "nuget"}, {"name": "Magick.NET-Q16-x64", "fixed": ["14.10.3"], "affected": "< 14.10.3", "ecosystem": "nuget"}, {"name": "Magick.NET-Q16-x86", "fixed": ["14.10.3"], "affected": "< 14.10.3", "ecosystem": "nuget"}, {"name": "Magick.NET-Q8-AnyCPU", "fixed": ["14.10.3"], "affected": "< 14.10.3", "ecosystem": "nuget"}, {"name": "Magick.NET-Q8-OpenMP-arm64", "fixed": ["14.10.3"], "affected": "< 14.10.3", "ecosystem": "nuget"}, {"name": "Magick.NET-Q8-OpenMP-x64", "fixed": ["14.10.3"], "affected": "< 14.10.3", "ecosystem": "nuget"}, {"name": "Magick.NET-Q8-arm64", "fixed": ["14.10.3"], "affected": "< 14.10.3", "ecosystem": "nuget"}, {"name": "Magick.NET-Q8-x64", "fixed": ["14.10.3"], "affected": "< 14.10.3", "ecosystem": "nuget"}, {"name": "Magick.NET-Q8-x86", "fixed": ["14.10.3"], "affected": "< 14.10.3", "ecosystem": "nuget"}, {"name": "imagemagick", "fixed": ["6.9.13-40"], "affected": ">= 6.9.0-0, < 6.9.13-40", "ecosystem": "vendor"}, {"name": "imagemagick", "fixed": ["7.1.2-15"], "affected": ">= 7.1.2-0, < 7.1.2-15", "ecosystem": "vendor"}] ecosystems: ["nuget", "vendor"] tags: ["cwe-125", "cwe-190", "dotnet", "image-processing", "imagemagick", "magick.net", "package"] not_affected_if: ["64-bit-only-builds", "no-untrusted-psd-input"] published_at: "2026-02-25T15:20:15+00:00" first_seen_at: "2026-11-03T17:41:47+00:00" updated_at: "2026-11-03T17:52:24+00:00" sources: [{"source": "ghsa", "url": "https://github.com/advisories/GHSA-273h-m46v-96q4", "first_seen_at": "2026-11-03T17:41:47+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-56367", "first_seen_at": "2026-11-03T17:52:24+00:00"}] --- # ImageMagick: Integer Overflow in PSB (PSD v2) RLE decoding path causes heap Out of Bounds reads for 32-bit builds A flaw in ImageMagick's PSB (PSD v2) RLE decoder is an integer overflow that causes a heap out-of-bounds read on 32-bit builds. An attacker who supplies a crafted PSB file can leak memory contents or crash the process. _Summary, check and fix written by a model from the sources; labelled as such._ ## Affected - nuget:Magick.NET-Q16-AnyCPU affected < 14.10.3 fixed 14.10.3 - nuget:Magick.NET-Q16-HDRI-AnyCPU affected < 14.10.3 fixed 14.10.3 - nuget:Magick.NET-Q16-HDRI-OpenMP-arm64 affected < 14.10.3 fixed 14.10.3 - nuget:Magick.NET-Q16-HDRI-OpenMP-x64 affected < 14.10.3 fixed 14.10.3 - nuget:Magick.NET-Q16-HDRI-arm64 affected < 14.10.3 fixed 14.10.3 - nuget:Magick.NET-Q16-HDRI-x64 affected < 14.10.3 fixed 14.10.3 - nuget:Magick.NET-Q16-HDRI-x86 affected < 14.10.3 fixed 14.10.3 - nuget:Magick.NET-Q16-OpenMP-arm64 affected < 14.10.3 fixed 14.10.3 - nuget:Magick.NET-Q16-OpenMP-x64 affected < 14.10.3 fixed 14.10.3 - nuget:Magick.NET-Q16-OpenMP-x86 affected < 14.10.3 fixed 14.10.3 - nuget:Magick.NET-Q16-arm64 affected < 14.10.3 fixed 14.10.3 - nuget:Magick.NET-Q16-x64 affected < 14.10.3 fixed 14.10.3 - nuget:Magick.NET-Q16-x86 affected < 14.10.3 fixed 14.10.3 - nuget:Magick.NET-Q8-AnyCPU affected < 14.10.3 fixed 14.10.3 - nuget:Magick.NET-Q8-OpenMP-arm64 affected < 14.10.3 fixed 14.10.3 - nuget:Magick.NET-Q8-OpenMP-x64 affected < 14.10.3 fixed 14.10.3 - nuget:Magick.NET-Q8-arm64 affected < 14.10.3 fixed 14.10.3 - nuget:Magick.NET-Q8-x64 affected < 14.10.3 fixed 14.10.3 - nuget:Magick.NET-Q8-x86 affected < 14.10.3 fixed 14.10.3 - vendor:imagemagick affected >= 6.9.0-0, < 6.9.13-40 fixed 6.9.13-40 - vendor:imagemagick affected >= 7.1.2-0, < 7.1.2-15 fixed 7.1.2-15 ## How to check - Check the installed Magick.NET package version in your project file or with `dotnet list package`, and compare it against `14.10.3`. - Look for 32-bit builds of the Q16 packages (x86 variants) that process untrusted PSB files. ## Fix - Magick.NET-Q16 packages (all variants): `14.10.3` ## Timeline - 2026-11-03T17:41:47+00:00 ghsa https://github.com/advisories/GHSA-273h-m46v-96q4 - 2026-11-03T17:52:24+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-56367 ## Documents - [advisory] Maintainer's advisory: api.github.com https://api.github.com/repos/ImageMagick/ImageMagick/security-advisories/GHSA-273h-m46v-96q4 - [advisory] Maintainer's advisory: github.com https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-273h-m46v-96q4 - [advisory] Third-party advisory: www.vulncheck.com https://www.vulncheck.com/advisories/imagemagick-heap-out-of-bounds-read-in-psb-rle-decoding - [fix] Patch: github.com https://github.com/ImageMagick/ImageMagick/commit/5b91ab69af614024255fd93dcc9a62b41fbc435c ## From the sources An integer overflow in the PSB (PSD v2) RLE decoding path causes a heap out-of-bounds read on 32-bit builds. This can lead to information disclosure or a crash when processing crafted PSB files. ``` ================================================================= ==3298==ERROR: AddressSanitizer: heap-buffer-overflow on address 0xf512eb00 at pc 0xf76760b5 bp 0xffc1dfb8 sp 0xffc1dfa8 READ of size 8 at 0xf512eb00 thread T0 #0 0xf76760b4 in ReadPSDChannelRLE coders/psd.c:1141 ``` --- _Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_