CVE-2026-56378: ImageMagick PCD Heap Out-of-Bounds Read

Technical summary

CVE-2026-56378 is a heap out-of-bounds read vulnerability in ImageMagick's PCD coder, specifically within the DecodeImage loop. The root cause is insufficient bounds checking when processing PCD image data during decoding operations. An attacker can craft a PCD file with malformed image parameters that cause the decoder to read one byte past the end of an allocated heap buffer. This violates memory safety and creates two distinct security consequences: service disruption through crash (denial of service) and potential information disclosure of an adjacent heap byte. The vulnerability affects both the current 7.x branch (before 7.1.2-15) and the legacy 6.x branch (before 6.9.13-40).

Business impact

Organizations relying on ImageMagick for automated image processing, document conversion pipelines, or content management systems face dual risks. Availability impact stems from denial-of-service conditions if malicious PCD files are processed, potentially disrupting batch operations or user-facing image services. The information disclosure aspect, while limited to a single byte, presents a secondary concern in environments handling sensitive metadata or confidential image content, as heap memory may contain cryptographic material, authentication tokens, or other sensitive artifacts. The low CVSS score reflects the attack constraints and limited scope, but should not minimize the importance of patching in production environments.

Affected systems

ImageMagick 7.x versions before 7.1.2-15 and ImageMagick 6.x versions before 6.9.13-40 are affected. Any system using ImageMagick for image processing is potentially vulnerable if it accepts PCD files from untrusted sources. This includes web services that process user-uploaded images, automated image conversion pipelines, document scanning and OCR workflows, and any containerized or serverless functions that invoke ImageMagick. Systems with ImageMagick installed as a dependency of other software (such as media libraries or web frameworks) should verify their specific version.

Exploitability

Exploitation requires a user or system to process a crafted PCD file through ImageMagick. The attack has no network-native exploitation path—delivery depends on user interaction or system misconfiguration. The vulnerability does not yield remote code execution and has high attack complexity (AC:H in CVSS terms), as the attacker must craft a specific malformed file that triggers the exact boundary condition. The impact is constrained to denial of service (predictable crash) or disclosure of a single byte, making large-scale information theft impractical. No active exploitation attempts have been reported in the KEV catalog.

Remediation

Update ImageMagick to version 7.1.2-15 or later for the 7.x branch, or to 6.9.13-40 or later for systems still on 6.x. Organizations unable to update immediately should restrict PCD file processing to trusted sources only, implement input validation to reject suspicious file structures, or disable PCD support in ImageMagick if not required. Verify patch versions against official ImageMagick release notes before deployment.

Patch guidance

Priority should be placed on updating production systems that process images from untrusted sources (user uploads, email attachments, external APIs). For 7.x deployments, upgrade to 7.1.2-15 or the latest stable release. For legacy 6.x systems, apply version 6.9.13-40 or migrate to the 7.x branch if operationally feasible. Test patches in a staging environment first to confirm compatibility with existing image processing workflows. Verify that dependent applications and container images are rebuilt or re-pulled to include the patched ImageMagick library.

Detection guidance

Monitor system logs for ImageMagick process crashes or segmentation faults when processing PCD files. In environments with detailed memory safety tooling (ASAN, Valgrind), heap out-of-bounds read events will be flagged during testing. Network-based detection is impractical since the vulnerability is triggered by file content, not network behavior. Apply patches and conduct a brief regression test with benign PCD files to confirm normal operation. In high-risk environments, consider temporarily disabling PCD support via ImageMagick configuration until patches are confirmed deployed.

Why prioritize this

Although the CVSS score is low (3.7), this vulnerability merits prompt attention in any environment processing untrusted image files. The denial-of-service vector can disrupt automated workflows, and information disclosure—while limited—could expose heap artifacts in sensitive contexts. The presence of two distinct impact types (confidentiality and availability) and the relative ease of triggering via a malformed file justifies inclusion in patch planning. Low complexity and no authentication requirement mean the barrier to delivery is minimal once a malicious PCD file is crafted and distributed.

Risk score, explained

The CVSS 3.1 score of 3.7 (LOW) reflects low network attack vector inherent complexity, no privilege elevation, no integrity impact, and limited scope. Confidentiality impact is rated low because only a single byte is disclosed. Availability impact is rated as none in the vector, though denial of service is acknowledged in the vulnerability description. The score appropriately captures the technical constraints but should not discourage patching in production systems handling untrusted image input; contextualize this score within your organization's image processing footprint and threat model.

Frequently asked questions