CVE-2026-56367: ImageMagick PSB Integer Overflow Information Disclosure

Technical summary

The vulnerability exists in the ReadPSDChannelRLE function within coders/psd.c. An integer overflow in the PSB RLE decoding path permits a heap out-of-bounds read on 32-bit systems. The flaw occurs when processing channel data in Photoshop version 2 documents; insufficient bounds checking combined with integer arithmetic allows an attacker to read memory beyond allocated heap buffers. This is classified as CWE-125 (out-of-bounds read). The condition is triggered during image decompression and does not require special privileges or user interaction to exploit.

Business impact

For organizations using ImageMagick in server-side image processing pipelines (web applications, document conversion services, media workflows), this vulnerability enables remote attackers to crash services or extract sensitive data from process memory. Although the CVSS score is low, the lack of authentication requirements and network accessibility make it relevant for any public-facing system that accepts PSB uploads. The information disclosure risk is particularly concerning in multi-tenant or shared environments where process memory may contain unrelated user data.

Affected systems

ImageMagick versions before 7.1.2-15 and 6.9.x versions before 6.9.13-40 are vulnerable. The flaw specifically impacts 32-bit builds; 64-bit systems are not affected by this integer overflow condition. Any deployment using an older version to process untrusted PSB or PSD files—such as online converters, thumbnail generators, or document management systems—is at risk.

Exploitability

Exploitation is network-accessible and requires no authentication, but the attack surface is limited to systems that process PSB files. An attacker must craft a malformed PSB file with specific RLE-encoded channel data that triggers the integer overflow. The complexity is rated as high (AC:H in the CVSS vector), reflecting the precision needed to construct a triggering input. However, once developed, a working proof-of-concept could be reliably reproduced. The vulnerability is not listed in the CISA KEV catalog, indicating no evidence of active exploitation to date.

Remediation

Update ImageMagick to version 7.1.2-15 or later for the 7.x branch, or 6.9.13-40 or later for the 6.9.x branch. If immediate patching is not feasible, disable PSB/PSD file processing in ImageMagick or restrict file upload functionality to trusted sources only. Consider disabling ImageMagick plugins in applications if only specific image formats are needed.

Patch guidance

Apply the following version updates: ImageMagick 7.1.2-15 or later, or ImageMagick 6.9.13-40 or later. Verify the installed version using 'identify -version'. After patching, test existing PSB workflows to ensure compatibility. Automated patch management systems should prioritize this update for any system exposed to untrusted file uploads. Check with your distribution or package manager for backported fixes if you are on a long-term support release that may not jump to the latest upstream version.

Detection guidance

Monitor logs for ImageMagick process crashes or segmentation faults when PSB files are processed. Endpoint detection and response (EDR) tools can flag abnormal memory access patterns in ImageMagick processes. Network-level detection is difficult without file inspection; however, monitoring for unexpected connections to image processing services followed by unusual process termination may indicate exploitation attempts. Review application error logs for out-of-memory or heap corruption errors correlating with PSB file submissions.

Why prioritize this

Although the CVSS score is low, the combination of network accessibility, lack of authentication, and remote crash capability warrants prompt patching for internet-facing systems. Organizations should prioritize this based on exposure: servers accepting file uploads rank higher than internal tools. The absence from the KEV catalog suggests this is not actively exploited, allowing a measured but timely response rather than emergency remediation.

Risk score, explained

CVSS 3.7 reflects low severity due to limited impact scope: information disclosure is possible but typically requires favorable memory layout, and the vulnerability does not enable code execution or unauthorized modification. The 'high' attack complexity (AC:H) reflects the difficulty in crafting a reliable trigger. However, the 'network' attack vector and 'none' privilege requirement mean any internet-connected system processing PSB files is exposed. Risk should be reassessed upward for organizations where information disclosure from process memory is particularly sensitive (e.g., financial data processing, healthcare image handling).

Frequently asked questions