MAGICK.NET-Q16-ANYCPU · CVE-2026-56378 · Package
FIX → 14.10.3 · 7.1.2-15 · 6.9.13-40
Magick.NET, the .NET wrapper for ImageMagick, reads one byte past a heap buffer when decoding a crafted PCD (Kodak Photo CD) image. An attacker who supplies such a file can crash the process and may read one adjacent heap byte.
first public Feb 23, 2026 · 2 sources
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Applications that use Magick.NET versions below 14.10.3 to decode images, especially those that accept PCD files from users or other untrusted sources. Applications that never decode untrusted images can skip it. The sources do not describe a configuration beyond the affected versions.
ImageMagick before 7.1.2-15 (and 6.x before 6.9.13-40) contains a heap out-of-bounds read in the PCD coder's DecodeImage loop. A crafted PCD file can trigger a one-byte heap out-of-bounds read during image decoding, resulting in denial of service and potential disclosure of an adjacent heap byte.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
Not affected if no-untrusted-images, version-14.10.3-or-later
Who cares cwe-125, dotnet, image-processing, imagemagick, magick.net
.csproj or packages.lock.json, and check the resolved version.Upgrade to 14.10.3 · 7.1.2-15 · 6.9.13-40
14.10.3GitHub Advisory Database, CC-BY 4.0 · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.