CVE-2026-24485

The record

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, when a PCD file does not contain a valid Sync marker, the DecodeImage() function becomes trapped in an infinite loop while searching for the Sync marker, causing the program to become unresponsive and continuously consume CPU resources, ultimately leading to system resource exhaustion and denial of service. Versions 7.1.2-15 and 6.9.13-40 contain a patch.

Affected packages

Related vulnerabilities

• GHSA-pqgj-2p96-rx85 ImageMagick: Infinite loop vulnerability when parsing a PCD file Same vulnerability
• CVE-2026-27799 ImageMagick is free and open-source software used for editing and manipulating digital… Also affects Magick.NET-Q16-AnyCPU
• CVE-2026-27798 ImageMagick is free and open-source software used for editing and manipulating digital… Also affects Magick.NET-Q16-AnyCPU
• GHSA-r99p-5442-q2x2 ImageMagick has a heap Buffer Over-read in its DJVU image format handler Also affects Magick.NET-Q16-AnyCPU
• GHSA-qpgx-jfcq-r59f ImageMagick: Heap Buffer Over-read in WaveletDenoise when processing small images Also affects Magick.NET-Q16-AnyCPU
• GHSA-gq5v-qf8q-fp77 ImageMagick: Heap-based Buffer Overflow in GetPixelIndex due to metadata-cache… Also affects Magick.NET-Q16-AnyCPU
• GHSA-wfx3-6g53-9fgc ImageMagick: Memory Leak in multiple coders that write raw pixel data Also affects Magick.NET-Q16-AnyCPU
• GHSA-3q5f-gmjc-38r8 ImageMagick: Memory leak in coders/txt.c without freetype Also affects Magick.NET-Q16-AnyCPU