{"id":"CVE-2026-56378","kind":"vulnerability","aliases":["CVE-2026-56378","GHSA-wgxp-q8xq-wpp9"],"related":[],"title":"ImageMagick: Malicious PCD files trigger 1‑byte heap Out-of-bounds Read and DoS","description":"ImageMagick before 7.1.2-15 (and 6.x before 6.9.13-40) contains a heap out-of-bounds read in the PCD coder's DecodeImage loop. A crafted PCD file can trigger a one-byte heap out-of-bounds read during image decoding, resulting in denial of service and potential disclosure of an adjacent heap byte.","summary":"Magick.NET, the .NET wrapper for ImageMagick, reads one byte past a heap buffer when decoding a crafted PCD (Kodak Photo CD) image. An attacker who supplies such a file can crash the process and may read one adjacent heap byte.","severity":"high","cvss":8.2,"epss":0.00389,"exploited":false,"exploited_at":null,"products":[{"name":"Magick.NET-Q16-AnyCPU","fixed":["14.10.3"],"affected":"< 14.10.3","ecosystem":"nuget"},{"name":"Magick.NET-Q16-HDRI-AnyCPU","fixed":["14.10.3"],"affected":"< 14.10.3","ecosystem":"nuget"},{"name":"Magick.NET-Q16-HDRI-OpenMP-arm64","fixed":["14.10.3"],"affected":"< 14.10.3","ecosystem":"nuget"},{"name":"Magick.NET-Q16-HDRI-OpenMP-x64","fixed":["14.10.3"],"affected":"< 14.10.3","ecosystem":"nuget"},{"name":"Magick.NET-Q16-HDRI-arm64","fixed":["14.10.3"],"affected":"< 14.10.3","ecosystem":"nuget"},{"name":"Magick.NET-Q16-HDRI-x64","fixed":["14.10.3"],"affected":"< 14.10.3","ecosystem":"nuget"},{"name":"Magick.NET-Q16-HDRI-x86","fixed":["14.10.3"],"affected":"< 14.10.3","ecosystem":"nuget"},{"name":"Magick.NET-Q16-OpenMP-arm64","fixed":["14.10.3"],"affected":"< 14.10.3","ecosystem":"nuget"},{"name":"Magick.NET-Q16-OpenMP-x64","fixed":["14.10.3"],"affected":"< 14.10.3","ecosystem":"nuget"},{"name":"Magick.NET-Q16-OpenMP-x86","fixed":["14.10.3"],"affected":"< 14.10.3","ecosystem":"nuget"},{"name":"Magick.NET-Q16-arm64","fixed":["14.10.3"],"affected":"< 14.10.3","ecosystem":"nuget"},{"name":"Magick.NET-Q16-x64","fixed":["14.10.3"],"affected":"< 14.10.3","ecosystem":"nuget"},{"name":"Magick.NET-Q16-x86","fixed":["14.10.3"],"affected":"< 14.10.3","ecosystem":"nuget"},{"name":"Magick.NET-Q8-AnyCPU","fixed":["14.10.3"],"affected":"< 14.10.3","ecosystem":"nuget"},{"name":"Magick.NET-Q8-OpenMP-arm64","fixed":["14.10.3"],"affected":"< 14.10.3","ecosystem":"nuget"},{"name":"Magick.NET-Q8-OpenMP-x64","fixed":["14.10.3"],"affected":"< 14.10.3","ecosystem":"nuget"},{"name":"Magick.NET-Q8-arm64","fixed":["14.10.3"],"affected":"< 14.10.3","ecosystem":"nuget"},{"name":"Magick.NET-Q8-x64","fixed":["14.10.3"],"affected":"< 14.10.3","ecosystem":"nuget"},{"name":"Magick.NET-Q8-x86","fixed":["14.10.3"],"affected":"< 14.10.3","ecosystem":"nuget"},{"name":"imagemagick","fixed":["6.9.13-40"],"affected":">= 6.9.0-0, < 6.9.13-40","ecosystem":"vendor"},{"name":"imagemagick","fixed":["7.1.2-15"],"affected":">= 7.1.2-0, < 7.1.2-15","ecosystem":"vendor"}],"ecosystems":["nuget","vendor"],"tags":["cwe-125","dotnet","image-processing","imagemagick","magick.net","package"],"not_affected_if":["no-untrusted-images","version-14.10.3-or-later"],"how_to_check":"- Look for the Magick.NET-Q16 or Magick.NET-Q8 packages in the project's `.csproj` or `packages.lock.json`, and check the resolved version.\n- Confirm whether the application passes user-supplied files to ImageMagick for decoding.","fix":"- Magick.NET packages (all Q8 and Q16 variants): upgrade to `14.10.3`","status":"open","published_at":"2026-02-25T19:12:23+00:00","first_seen_at":"2026-11-06T18:11:02+00:00","triaged_at":"2026-11-06T18:11:56+00:00","updated_at":"2026-11-06T18:13:15+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-06T18:11:56Z","model":"claude-haiku-5-5","output":{"fix":"- Magick.NET packages (all Q8 and Q16 variants): upgrade to `14.10.3`","reach":"unknown","title":"Magick.NET: malicious PCD image file causes heap over-read and crash","impact":"low","summary":"Magick.NET, the .NET wrapper for ImageMagick, reads one byte past a heap buffer when decoding a crafted PCD (Kodak Photo CD) image. An attacker who supplies such a file can crash the process and may read one adjacent heap byte.","audience":"developers","category":"package","nicknames":[],"who_cares":["dotnet","magick.net","imagemagick","image-processing"],"confidence":0.7,"fix_status":"available","needs_auth":"no","worst_case":"process crashes and one adjacent heap byte may leak","analyst_note":"","how_to_check":"- Look for the Magick.NET-Q16 or Magick.NET-Q8 packages in the project's `.csproj` or `packages.lock.json`, and check the resolved version.\n- Confirm whether the application passes user-supplied files to ImageMagick for decoding.","plain_action":"","needs_analyst":false,"not_affected_if":["no-untrusted-images","version-14.10.3-or-later"],"who_is_affected":"Applications that use Magick.NET versions below 14.10.3 to decode images, especially those that accept PCD files from users or other untrusted sources. Applications that never decode untrusted images can skip it. The sources do not describe a configuration beyond the affected versions.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.00078,"input_tokens":4983,"output_tokens":564,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-125':119B '-15':170C '-2026':17A,25A '-40':176C '-56378':18A,26A '1':6A '6':172C '6.9.13':175C '7.1.2':169C 'adjac':164B,221C 'anycpu':30A,35A,93A 'arm64':41A,52A,67A,81A,98A,107A 'attack':150B 'bound':12A,183C,206C 'buffer':139B 'byte':7A,135B,166B,201C,223C 'cd':147B 'coder':188C 'contain':177C 'craft':143B,193C 'crash':157B 'cve':16A,24A 'cwe':118B 'decod':141B,210C 'decodeimag':190C 'denial':213C 'disclosur':218C 'dos':15A 'dotnet':120B 'file':4A,155B,195C 'ghsa':20A 'ghsa-wgxp-q8xq-wpp9':19A 'hdri':34A,39A,45A,51A,56A,61A 'heap':8A,138B,165B,179C,202C,222C 'imag':122B,148B,209C 'image-process':121B 'imagemagick':1A,116A,117A,124B,132B,167C 'kodak':145B 'loop':191C 'magick.net':27A,31A,36A,42A,48A,53A,58A,63A,68A,73A,78A,82A,86A,90A,94A,99A,104A,108A,112A,125B,127B 'malici':2A 'may':161B 'net':129B 'one':134B,163B,200C 'one-byt':199C 'openmp':40A,46A,66A,71A,76A,97A,102A 'out-of-bound':9A,180C,203C 'packag':126B 'past':136B 'pcd':3A,144B,187C,194C 'photo':146B 'potenti':217C 'process':123B,159B 'q16':29A,33A,38A,44A,50A,55A,60A,65A,70A,75A,80A,84A,88A 'q16-anycpu':28A 'q16-arm64':79A 'q16-hdri-anycpu':32A 'q16-hdri-arm64':49A 'q16-hdri-openmp-arm64':37A 'q16-hdri-openmp-x64':43A 'q16-hdri-x64':54A 'q16-hdri-x86':59A 'q16-openmp-arm64':64A 'q16-openmp-x64':69A 'q16-openmp-x86':74A 'q16-x64':83A 'q16-x86':87A 'q8':92A,96A,101A,106A,110A,114A 'q8-anycpu':91A 'q8-arm64':105A 'q8-openmp-arm64':95A 'q8-openmp-x64':100A 'q8-x64':109A 'q8-x86':113A 'q8xq':22A 'read':13A,133B,162B,184C,207C 'result':211C 'servic':215C 'suppli':152B 'trigger':5A,197C 'wgxp':21A 'wpp9':23A 'wrapper':130B 'x':173C 'x64':47A,57A,72A,85A,103A,111A 'x86':62A,77A,89A,115A","nicknames":[],"mitigations":[],"who_affected":"Applications that use Magick.NET versions below 14.10.3 to decode images, especially those that accept PCD files from users or other untrusted sources. Applications that never decode untrusted images can skip it. The sources do not describe a configuration beyond the affected versions.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":["imagemagick","magicknetq16anycpu","magicknetq16arm64","magicknetq16hdrianycpu","magicknetq16hdriarm64","magicknetq16hdriopenmparm64","magicknetq16hdriopenmpx64","magicknetq16hdrix64","magicknetq16hdrix86","magicknetq16openmparm64","magicknetq16openmpx64","magicknetq16openmpx86","magicknetq16x64","magicknetq16x86","magicknetq8anycpu","magicknetq8arm64","magicknetq8openmparm64","magicknetq8openmpx64","magicknetq8x64","magicknetq8x86"],"ptokens":["anycpu","arm64","hdri","imagemagick","magick","net","openmp","q16","q8","x64","x86"],"labels":["cwe125","dotnet","high","imagemagick","imageprocessing","magicknet","nuget","package","vendor"],"campaign_type":null,"search_a":"'-2026':17A,25A '-56378':18A,26A '1':6A 'anycpu':30A,35A,93A 'arm64':41A,52A,67A,81A,98A,107A 'bound':12A 'byte':7A 'cve':16A,24A 'dos':15A 'file':4A 'ghsa':20A 'ghsa-wgxp-q8xq-wpp9':19A 'hdri':34A,39A,45A,51A,56A,61A 'heap':8A 'imagemagick':1A,116A,117A 'magick.net':27A,31A,36A,42A,48A,53A,58A,63A,68A,73A,78A,82A,86A,90A,94A,99A,104A,108A,112A 'malici':2A 'openmp':40A,46A,66A,71A,76A,97A,102A 'out-of-bound':9A 'pcd':3A 'q16':29A,33A,38A,44A,50A,55A,60A,65A,70A,75A,80A,84A,88A 'q16-anycpu':28A 'q16-arm64':79A 'q16-hdri-anycpu':32A 'q16-hdri-arm64':49A 'q16-hdri-openmp-arm64':37A 'q16-hdri-openmp-x64':43A 'q16-hdri-x64':54A 'q16-hdri-x86':59A 'q16-openmp-arm64':64A 'q16-openmp-x64':69A 'q16-openmp-x86':74A 'q16-x64':83A 'q16-x86':87A 'q8':92A,96A,101A,106A,110A,114A 'q8-anycpu':91A 'q8-arm64':105A 'q8-openmp-arm64':95A 'q8-openmp-x64':100A 'q8-x64':109A 'q8-x86':113A 'q8xq':22A 'read':13A 'trigger':5A 'wgxp':21A 'wpp9':23A 'x64':47A,57A,72A,85A,103A,111A 'x86':62A,77A,89A,115A","search_b":"'-125':119B 'adjac':164B 'attack':150B 'buffer':139B 'byte':135B,166B 'cd':147B 'craft':143B 'crash':157B 'cwe':118B 'decod':141B 'dotnet':120B 'file':155B 'heap':138B,165B 'imag':122B,148B 'image-process':121B 'imagemagick':124B,132B 'kodak':145B 'magick.net':125B,127B 'may':161B 'net':129B 'one':134B,163B 'packag':126B 'past':136B 'pcd':144B 'photo':146B 'process':123B,159B 'read':133B,162B 'suppli':152B 'wrapper':130B","search_c":"'-15':170C '-40':176C '6':172C '6.9.13':175C '7.1.2':169C 'adjac':221C 'bound':183C,206C 'byte':201C,223C 'coder':188C 'contain':177C 'craft':193C 'decod':210C 'decodeimag':190C 'denial':213C 'disclosur':218C 'file':195C 'heap':179C,202C,222C 'imag':209C 'imagemagick':167C 'loop':191C 'one':200C 'one-byt':199C 'out-of-bound':180C,203C 'pcd':187C,194C 'potenti':217C 'read':184C,207C 'result':211C 'servic':215C 'trigger':197C 'x':173C","first_public_at":"2026-02-23T20:44:33+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","cvss_by":"GitHub","poc_count":0,"sources":[{"source":"ghsa","external_id":"GHSA-wgxp-q8xq-wpp9","url":"https://github.com/advisories/GHSA-wgxp-q8xq-wpp9","severity":"medium","published_at":"2026-02-25T19:12:23+00:00","modified_at":"2026-11-06T18:06:14+00:00","first_seen_at":"2026-11-06T18:11:02+00:00","fetched_at":"2026-11-06T18:19:44+00:00","note":null},{"source":"nvd","external_id":"CVE-2026-56378","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-56378","severity":null,"published_at":"2026-06-21T14:16:25+00:00","modified_at":"2026-10-29T21:17:25+00:00","first_seen_at":"2026-11-06T18:13:15+00:00","fetched_at":"2026-11-06T18:13:15+00:00","note":null}],"documents":[{"id":88435,"url":"https://api.github.com/repos/ImageMagick/ImageMagick/security-advisories/GHSA-wgxp-q8xq-wpp9","title":"Maintainer's advisory: api.github.com","kind":"vendor","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Maintainer's advisory: api.github.com"},{"id":88436,"url":"https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-wgxp-q8xq-wpp9","title":"Maintainer's advisory: github.com","kind":"vendor","source":"ghsa","publisher":"vendor","text":null,"published_at":"2026-02-23T20:44:33+00:00","relation":"advisory","confidence":null,"note":"Maintainer's advisory: github.com"},{"id":88437,"url":"https://github.com/ImageMagick/ImageMagick/commit/436e5d2589e3c0adc10d9aa189e81d5d088d8207","title":"Patch: github.com","kind":"other","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":88584,"url":"https://www.vulncheck.com/advisories/imagemagick-heap-out-of-bounds-read-in-pcd-decoder","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"exploit_sources":[{"type":"epss","score":0.00389,"url":"https://api.first.org/data/v1/epss?cve=CVE-2026-56378"}],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}