CVE-2026-45031

What it actually does

The flaw is a denial-of-service weakness in ImageMagick's PSD image decoder. A missing validation check allows a crafted Photoshop PSD file to bypass the configured list-length resource policy during decoding. Although other ImageMagick resource limits still apply, the bypass can cause excessive memory, CPU, or processing-resource consumption relative to the intended policy, potentially degrading or interrupting services that automatically process untrusted images.

Why it matters to the business

Systems that accept or process user-supplied images may experience slowdowns, failed image conversions, job-queue backlogs, or temporary service disruption if an attacker submits specially crafted PSD files. The CVSS score indicates moderate severity and EPSS is currently low, with no known KEV listing or mature public exploitation reported, but exposure can still matter for high-volume upload services, media pipelines, document processing platforms, and any service where image conversion availability is business-critical.

How an attack unfolds

An attacker identifies an application, API, batch-processing workflow, or backend service that uses vulnerable ImageMagick versions to decode PSD files. The attacker then submits or causes the system to process a specially crafted PSD image designed to trigger the missing list-length policy check in the decoder. When ImageMagick parses the file, the configured list-length resource policy is not enforced as expected, allowing the decode operation to consume more resources than intended until other resource limits intervene. The result is typically service degradation rather than code execution: conversion workers may hang, slow down, fail, restart, exhaust quotas, or create backlogs that reduce availability for legitimate image-processing tasks.

How to fix it

Upgrade ImageMagick to a patched release: 6.9.13-47 or later for the 6.x branch, or 7.1.2-22 or later for the 7.x branch. Where ImageMagick is bundled into an operating system package, container image, application appliance, or language runtime dependency, apply the vendor-provided security update rather than relying only on upstream version strings. If immediate patching is not possible, reduce exposure by blocking or disabling PSD decoding for untrusted uploads, enforcing strict file size and pixel-dimension limits before ImageMagick processing, running conversions in isolated worker sandboxes with memory/CPU/time limits, limiting upload rates, and ensuring queue backpressure prevents a single input class from exhausting processing capacity.

How to confirm the fix worked

Confirm installed ImageMagick versions with `magick -version`, `convert -version`, package-manager inventory, container image scans, and software composition analysis. Verify that the deployed version is 6.9.13-47 or later, or 7.1.2-22 or later, accounting for distribution backports. Review ImageMagick policy configuration to ensure resource limits for memory, map, disk, time, area, width, height, and file size are set appropriately, while recognizing that patching is required to fix the PSD list-length policy bypass itself. Test exposed upload and conversion paths with benign PSD files after upgrading to confirm normal processing still works and that oversized or policy-violating files are rejected or terminated cleanly. Validate mitigation by confirming PSD uploads are blocked where intended, conversion workers are resource-constrained, and failed conversions do not destabilize the broader service.

Typical attack path

1. Find an externally reachable upload, conversion, thumbnailing, preview, or document-processing path that accepts PSD or image files.
2. Confirm or infer that the service uses ImageMagick to decode submitted images.
3. Create or obtain a malformed PSD file that triggers the PSD decoder resource-policy bypass.
4. Submit the crafted PSD repeatedly or at high volume to the target image-processing path.
5. Cause ImageMagick workers to consume excessive processing resources until conversions fail, queues grow, or service availability is degraded.
6. Optionally repeat the activity to sustain operational impact or exhaust autoscaling and processing capacity.

How to detect it

To determine whether this issue was already exploited, review application upload logs, API gateway logs, web server access logs, object-storage events, job-queue telemetry, and image-conversion worker logs for PSD files submitted shortly before CPU, memory, timeout, restart, or queue-depth spikes. Focus on repeated uploads of `.psd` files, unusually large or malformed PSDs, high conversion failure rates, ImageMagick timeout/resource-limit messages, worker crashes, container OOM kills, and bursts from the same source IP, account, token, user agent, or automation pattern. Correlate conversion failures with system metrics such as sustained CPU saturation, memory pressure, disk spillover, autoscaling events, and delayed processing jobs. For host and container forensics, inspect process execution records for `magick`, `convert`, or application worker processes handling PSD inputs that terminated due to timeouts, resource limits, or out-of-memory conditions. No public exploit-specific payload signature is available from the provided information, so detection should emphasize behavior, file type, and resource-exhaustion artifacts rather than a unique byte pattern.

• .psd
• PSD
• image/vnd.adobe.photoshop
• magick
• convert
• identify
• MagickCore
• MagickWand
• no decode delegate for this image format
• cache resources exhausted
• memory allocation failed
• time limit exceeded
• width or height exceeds limit
• area exceeds limit
• Killed process
• Out of memory: Killed process
• OOMKilled
• exit code 137
• SIGKILL
• resource temporarily unavailable
• policy.xml

What your security team should do

• Inventory all applications, containers, CI/CD jobs, media-processing workers, and document-conversion services that use ImageMagick, including indirectly through application frameworks or third-party packages.
• Prioritize patching internet-facing or user-upload-facing image-processing services to ImageMagick 6.9.13-47/7.1.2-22 or later.
• If patching cannot be completed quickly, temporarily disable PSD processing for untrusted content or route PSD files to a hardened, isolated processing tier.
• Enforce layered resource controls around image conversion, including process timeouts, memory limits, CPU quotas, disk quotas, worker isolation, and upload rate limits.
• Monitor image-processing error rates, worker restarts, queue depth, CPU and memory spikes, and repeated PSD submissions for signs of attempted denial-of-service activity.
• Update detection content and incident runbooks to include PSD-driven ImageMagick resource-exhaustion scenarios, even though no known KEV exploitation or ransomware use is currently reported.
• Ensure base container images and operating system packages are rebuilt and redeployed after patching, since vulnerable ImageMagick libraries often persist in long-lived images.