CVE-2026-56367

What it actually does

ImageMagick contains an integer overflow in the PSB/PSD v2 run-length encoding decoder, specifically in the ReadPSDChannelRLE path in coders/psd.c. On 32-bit builds, a crafted PSB file can cause incorrect size calculations that lead to a heap out-of-bounds read while ImageMagick parses image channel data. The likely outcomes are process crash or limited memory disclosure from the affected ImageMagick process. The issue does not provide a direct write primitive, authentication bypass, or known remote code execution path based on the available information, and exploitation requires a specially crafted image to be processed by a vulnerable 32-bit ImageMagick build.

Why it matters to the business

Organizations that accept, transform, thumbnail, validate, or inspect user-supplied images with ImageMagick may experience denial of service in image-processing workflows or limited exposure of process memory if a malicious PSB file is processed. The risk is lower than many server-side image parsing flaws because it is limited to 32-bit builds, has high attack complexity, has no known public exploit maturity, is not listed in CISA KEV, and has a low EPSS score; however, ImageMagick is commonly embedded in web applications, content management systems, document pipelines, media platforms, and automation jobs, so vulnerable deployments should still be remediated during normal patch cycles.

How an attack unfolds

An attacker first identifies an application or service that uses ImageMagick to process uploaded or externally supplied images. They then craft a PSB file with malformed RLE channel metadata designed to trigger an integer overflow during PSD v2 decoding on a 32-bit ImageMagick build. When the vulnerable service processes the file, ImageMagick miscalculates buffer bounds and reads beyond the intended heap allocation. Depending on memory layout and runtime behavior, this can crash the image conversion process or disclose limited adjacent memory contents through generated output, error behavior, or downstream handling. Successful exploitation is constrained by the need for PSB parsing to be enabled, the target to use a vulnerable 32-bit build, and the crafted file to reach an ImageMagick processing path.

How to fix it

Upgrade ImageMagick to a fixed release: 7.1.2-15 or later for the 7.x branch, or 6.9.13-40 or later for the 6.9.x branch. Give priority to systems that process untrusted uploads or external files and to any remaining 32-bit builds. If immediate upgrade is not possible, mitigate by disabling PSD/PSB decoding in ImageMagick policy where business processes allow it, rejecting PSB/PSD uploads at application and gateway layers, enforcing strict file type allowlists, running image processing in a sandboxed low-privilege environment, applying memory and CPU limits to worker processes, and isolating conversion jobs from sensitive data and network access. Prefer 64-bit supported builds where feasible, while still applying the vendor fix.

How to confirm the fix worked

Confirm the installed ImageMagick version with commands such as `magick -version`, `convert -version`, or package-manager inventory and verify it is 7.1.2-15 or later, or 6.9.13-40 or later. Confirm whether deployed packages are 32-bit or 64-bit and prioritize removal or upgrade of vulnerable 32-bit builds. Review ImageMagick policy configuration to ensure PSD/PSB coders are disabled if that mitigation is intended. Test upload and conversion paths to verify that PSB/PSD files are either rejected or processed by a fixed version. For containerized workloads, validate both the base image package and any statically bundled ImageMagick libraries inside application images, build artifacts, and language-specific wrappers such as image processing gems, modules, or bindings.

Typical attack path

1. Find an externally reachable upload, conversion, thumbnailing, preview, metadata extraction, or document-processing feature that invokes ImageMagick.
2. Confirm or infer that the backend accepts PSD/PSB files or does not strictly restrict image formats before processing.
3. Prepare a malformed PSB file with crafted RLE channel data intended to overflow size calculations in the PSD decoder.
4. Submit the crafted file through the application, API, email attachment flow, batch import, or other ingestion path.
5. Trigger ImageMagick processing of the file using operations such as identify, convert, magick, thumbnail generation, or metadata extraction.
6. Observe service instability, worker crashes, failed conversions, unusual error responses, or possible leakage of process memory into output or logs.

How to detect it

To determine whether this flaw was already targeted, review logs from web upload endpoints, API gateways, object storage ingestion events, image conversion workers, batch media processors, email/document processing systems, and container or host process supervisors. Look for PSD or PSB files submitted shortly before ImageMagick worker crashes, segmentation faults, abnormal exits, core dumps, or repeated conversion failures. Correlate file names, MIME types, source IPs, user agents, upload timestamps, and worker restart events. On Linux systems, inspect syslog, journald, container runtime logs, application logs, crash dump directories, and audit logs for ImageMagick commands such as `magick`, `convert`, or `identify` processing `.psb` or `.psd` files. Review stored uploaded files or quarantine buckets for unusual PSB files, especially those with large dimensions, abnormal channel counts, or malformed RLE-compressed channel data. Because there are no publicly known exploit-specific signatures from the provided data, detection should focus on suspicious PSB/PSD processing combined with crashes or memory-related errors in vulnerable 32-bit ImageMagick deployments.

• ReadPSDChannelRLE
• coders/psd.c
• PSB
• PSD
• \.psb
• \.psd
• magick: memory allocation failed
• magick: insufficient image data in file
• magick: corrupt image
• magick: improper image header
• convert: memory allocation failed
• convert: insufficient image data in file
• convert: corrupt image
• identify: memory allocation failed
• identify: insufficient image data in file
• Segmentation fault
• segfault at
• core dumped
• magick identify
• magick convert
• convert -
• identify -

What your security team should do

• Inventory all applications, containers, servers, build images, and third-party processing pipelines that invoke ImageMagick or linked delegates for image parsing.
• Patch ImageMagick to 7.1.2-15 or later, or 6.9.13-40 or later, prioritizing internet-facing and user-upload processing systems.
• Identify and retire vulnerable 32-bit ImageMagick deployments where possible, as the described out-of-bounds read condition is specific to 32-bit builds.
• Temporarily block or quarantine PSD and PSB files from untrusted sources if patching cannot be completed promptly.
• Run ImageMagick with least privilege, sandboxing, resource limits, and filesystem isolation to reduce the impact of parser crashes or memory disclosure.
• Search recent upload, conversion, and worker logs for PSB/PSD processing failures, crashes, and malformed image errors that may indicate probing.
• Ensure monitoring alerts on repeated image-processing crashes, abnormal worker restarts, and spikes in failed PSD/PSB conversions.
• Update dependency and container scanning policies to detect vulnerable ImageMagick package versions in both operating system packages and application-bundled binaries.