{"id":"GHSA-jmqv-2mx7-544h","kind":"vulnerability","aliases":["GHSA-jmqv-2mx7-544h"],"related":[],"title":"Duplicate Advisory: ImageMagick: Malicious PCD files trigger 1‑byte heap Out-of-bounds Read and DoS","description":"### Duplicate Advisory\nThis advisory has been withdrawn because it is a duplicate of GHSA-wgxp-q8xq-wpp9. This link is maintained to preserve external references.\n\n### Original Description\nImageMagick before 7.1.2-15 (and 6.x before 6.9.13-40) contains a heap out-of-bounds read in the PCD coder's DecodeImage loop. A crafted PCD file can trigger a one-byte heap out-of-bounds read during image decoding, resulting in denial of service and potential disclosure of an adjacent heap byte.","summary":"This advisory is withdrawn as a duplicate of GHSA-wgxp-q8xq-wpp9. The original text says a crafted PCD image file can trigger a one-byte heap out-of-bounds read during decoding, causing denial of service and possibly leaking an adjacent heap byte.","severity":"medium","cvss":3.7,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Magick.NET-Q16-AnyCPU","fixed":["14.10.3"],"affected":"< 14.10.3","ecosystem":"nuget"}],"ecosystems":["nuget"],"tags":["cwe-125","dotnet","image-processing","imagemagick","nuget","package"],"not_affected_if":["fixed-version","no-pcd-decoding"],"how_to_check":"- Check whether the project references the `Magick.NET-Q16-AnyCPU` NuGet package and its version, for example in the `.csproj` file or `packages.lock.json`.\n- Check whether the app decodes untrusted PCD files.","fix":"- `Magick.NET-Q16-AnyCPU` versions before `14.10.3` are affected; the source lists `14.10.3` as fixed.\n- Use GHSA-wgxp-q8xq-wpp9 for the current advisory.","status":"withdrawn","published_at":"2026-06-21T15:31:24+00:00","first_seen_at":"2026-11-06T18:11:02+00:00","triaged_at":"2026-11-06T18:11:56+00:00","updated_at":"2026-11-06T18:11:56+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-06T18:11:56Z","model":"claude-haiku-5-5","output":{"fix":"- `Magick.NET-Q16-AnyCPU` versions before `14.10.3` are affected; the source lists `14.10.3` as fixed.\n- Use GHSA-wgxp-q8xq-wpp9 for the current advisory.","reach":"unknown","title":"Magick.NET: malicious PCD file causes one-byte heap out-of-bounds read","impact":"low","summary":"This advisory is withdrawn as a duplicate of GHSA-wgxp-q8xq-wpp9. The original text says a crafted PCD image file can trigger a one-byte heap out-of-bounds read during decoding, causing denial of service and possibly leaking an adjacent heap byte.","audience":"developers","category":"package","nicknames":[],"who_cares":["dotnet","nuget","imagemagick","image-processing"],"confidence":0.6,"fix_status":"available","needs_auth":"no","worst_case":"Process crashes or leaks one adjacent heap byte during decoding","analyst_note":"","how_to_check":"- Check whether the project references the `Magick.NET-Q16-AnyCPU` NuGet package and its version, for example in the `.csproj` file or `packages.lock.json`.\n- Check whether the app decodes untrusted PCD files.","plain_action":"","needs_analyst":false,"not_affected_if":["fixed-version","no-pcd-decoding"],"who_is_affected":"Applications that use the Magick.NET-Q16-AnyCPU NuGet package below 14.10.3 to decode image files, especially when they accept PCD files from users or other untrusted sources. Systems that never decode PCD files or that use a fixed version can skip it.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000748,"input_tokens":4393,"output_tokens":617,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-125':33B '-15':119C '-40':125C '1':8A '2mx7':21A,26A '544h':22A,27A '6':121C '6.9.13':124C '7.1.2':118C 'adjac':85B,170C 'advisori':2A,42B,89C,91C 'anycpu':31A 'bound':14A,73B,132C,155C 'byte':9A,68B,87B,150C,172C 'caus':77B 'coder':137C 'contain':126C 'craft':59B,142C 'cwe':32B 'decod':76B,159C 'decodeimag':139C 'denial':78B,162C 'descript':115C 'disclosur':167C 'dos':17A 'dotnet':34B 'duplic':1A,47B,88C,99C 'extern':112C 'file':6A,62B,144C 'ghsa':19A,24A,50B,102C 'ghsa-jmqv-2mx7-544h':18A,23A 'ghsa-wgxp-q8xq-wpp9':49B,101C 'heap':10A,69B,86B,128C,151C,171C 'imag':36B,61B,158C 'image-process':35B 'imagemagick':3A,38B,116C 'jmqv':20A,25A 'leak':83B 'link':107C 'loop':140C 'magick.net':28A 'maintain':109C 'malici':4A 'nuget':39B 'one':67B,149C 'one-byt':66B,148C 'origin':55B,114C 'out-of-bound':11A,70B,129C,152C 'packag':40B 'pcd':5A,60B,136C,143C 'possibl':82B 'potenti':166C 'preserv':111C 'process':37B 'q16':30A 'q16-anycpu':29A 'q8xq':52B,104C 'read':15A,74B,133C,156C 'refer':113C 'result':160C 'say':57B 'servic':80B,164C 'text':56B 'trigger':7A,64B,146C 'wgxp':51B,103C 'withdrawn':44B,94C 'wpp9':53B,105C 'x':122C","nicknames":[],"mitigations":[],"who_affected":"Applications that use the Magick.NET-Q16-AnyCPU NuGet package below 14.10.3 to decode image files, especially when they accept PCD files from users or other untrusted sources. Systems that never decode PCD files or that use a fixed version can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":["magicknetq16anycpu"],"ptokens":["anycpu","magick","net","q16"],"labels":["cwe125","dotnet","imagemagick","imageprocessing","medium","nuget","package"],"campaign_type":null,"search_a":"'1':8A '2mx7':21A,26A '544h':22A,27A 'advisori':2A 'anycpu':31A 'bound':14A 'byte':9A 'dos':17A 'duplic':1A 'file':6A 'ghsa':19A,24A 'ghsa-jmqv-2mx7-544h':18A,23A 'heap':10A 'imagemagick':3A 'jmqv':20A,25A 'magick.net':28A 'malici':4A 'out-of-bound':11A 'pcd':5A 'q16':30A 'q16-anycpu':29A 'read':15A 'trigger':7A","search_b":"'-125':33B 'adjac':85B 'advisori':42B 'bound':73B 'byte':68B,87B 'caus':77B 'craft':59B 'cwe':32B 'decod':76B 'denial':78B 'dotnet':34B 'duplic':47B 'file':62B 'ghsa':50B 'ghsa-wgxp-q8xq-wpp9':49B 'heap':69B,86B 'imag':36B,61B 'image-process':35B 'imagemagick':38B 'leak':83B 'nuget':39B 'one':67B 'one-byt':66B 'origin':55B 'out-of-bound':70B 'packag':40B 'pcd':60B 'possibl':82B 'process':37B 'q8xq':52B 'read':74B 'say':57B 'servic':80B 'text':56B 'trigger':64B 'wgxp':51B 'withdrawn':44B 'wpp9':53B","search_c":"'-15':119C '-40':125C '6':121C '6.9.13':124C '7.1.2':118C 'adjac':170C 'advisori':89C,91C 'bound':132C,155C 'byte':150C,172C 'coder':137C 'contain':126C 'craft':142C 'decod':159C 'decodeimag':139C 'denial':162C 'descript':115C 'disclosur':167C 'duplic':88C,99C 'extern':112C 'file':144C 'ghsa':102C 'ghsa-wgxp-q8xq-wpp9':101C 'heap':128C,151C,171C 'imag':158C 'imagemagick':116C 'link':107C 'loop':140C 'maintain':109C 'one':149C 'one-byt':148C 'origin':114C 'out-of-bound':129C,152C 'pcd':136C,143C 'potenti':166C 'preserv':111C 'q8xq':104C 'read':133C,156C 'refer':113C 'result':160C 'servic':164C 'trigger':146C 'wgxp':103C 'withdrawn':94C 'wpp9':105C 'x':122C","first_public_at":"2026-06-21T15:31:24+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","cvss_by":"GitHub","poc_count":0,"sources":[{"source":"ghsa","external_id":"GHSA-jmqv-2mx7-544h","url":"https://github.com/advisories/GHSA-jmqv-2mx7-544h","severity":"medium","published_at":"2026-06-21T15:31:24+00:00","modified_at":"2026-11-06T18:06:08+00:00","first_seen_at":"2026-11-06T18:11:02+00:00","fetched_at":"2026-11-06T18:11:02+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}