Live › vulnerability › GHSA-rg39-4fm5-hrp2
This advisory is a withdrawn duplicate of GHSA-273h-m46v-96q4, which covers the same ImageMagick PSB decoding flaw. A crafted PSB file processed on a 32-bit build can read heap memory out of bounds, leaking data or crashing the process.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-03 17:41 UTC. All times on this page are UTC.
Applications that use the 32-bit Magick.NET-Q8-x86 build (or a 32-bit ImageMagick build) to decode PSB files from untrusted sources. Systems on 64-bit builds or those that never handle PSD/PSB uploads are less exposed. The advisory itself is withdrawn in favour of GHSA-273h-m46v-96q4, so refer to that entry for the authoritative details.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| Magick.NET-Q8-x86 | nuget | < 14.10.3 | 14.10.3 |
14.10.3.14.10.3 (per the product range in this advisory).7.1.2-15 and 6.9.13-40 as fixed versions.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
This advisory has been withdrawn because it is a duplicate of GHSA-273h-m46v-96q4. This link is maintained to preserve external references.
ImageMagick before 7.1.2-15 and 6.9.x before 6.9.13-40 contains an integer overflow in the PSB (PSD v2) RLE decoding path (ReadPSDChannelRLE in coders/psd.c) that causes a heap out-of-bounds read on 32-bit builds. Processing a crafted PSB file can lead to information disclosure or a crash.
This page as .md · .json · in your agent: get_signal("GHSA-rg39-4fm5-hrp2")
GitHub Advisory Database, CC-BY 4.0. Posts quoted belong to their authors.