CVE-2026-56378

What it actually does

ImageMagick’s PCD image decoder contains a heap out-of-bounds read in the DecodeImage loop. A malformed Kodak Photo CD / PCD image can cause ImageMagick to read one byte past the intended heap buffer during decoding. The most likely result is process crash or controlled denial of service in applications that automatically parse uploaded, fetched, or converted images. Limited disclosure of one adjacent heap byte may be possible depending on allocator behavior, error handling, and whether decoded output or diagnostics expose the read data. The issue affects ImageMagick versions before 7.1.2-15 and 6.x versions before 6.9.13-40.

Why it matters to the business

Services that rely on ImageMagick for image upload validation, thumbnail generation, document conversion, media processing, or background batch jobs may be disrupted by a specially crafted PCD file. The current public risk appears limited: CVSS is low, EPSS is very low, it is not in CISA KEV, ransomware use is not reported, and no mature exploit is noted. However, ImageMagick is widely embedded in web applications, content pipelines, SaaS platforms, developer tooling, and downstream packages, so exposure can be indirect and easy to miss.

How an attack unfolds

An attacker prepares a malformed PCD file that triggers the vulnerable DecodeImage logic in ImageMagick. The attacker then submits or delivers that file to a service that invokes ImageMagick automatically, such as an image upload endpoint, file conversion workflow, email/document previewer, CMS media library, or asynchronous thumbnail worker. When the file is decoded, the PCD coder reads one byte beyond the heap buffer. In many deployments this causes the ImageMagick process, worker process, or calling application component to crash, potentially interrupting processing queues or request handling. In less common conditions, the adjacent heap byte could influence output or logs, creating a narrow information-disclosure risk. Successful exploitation generally requires the target to accept or process PCD files or to allow file type confusion that routes attacker-controlled content to the PCD decoder.

How to fix it

Upgrade ImageMagick to a fixed release: 7.1.2-15 or later for the 7.x branch, or 6.9.13-40 or later for the 6.x branch. Where ImageMagick is supplied by an operating-system package manager, apply the vendor security update because fixed packages may use backported patches while retaining older upstream version strings. Also update bundled copies in containers, serverless images, language-specific packages, desktop applications, CI images, and media-processing workers. If immediate upgrade is not possible, reduce exposure by disabling the PCD coder in ImageMagick policy configuration, blocking PCD uploads, enforcing strict allowlists for image formats, validating file magic before processing, and isolating ImageMagick execution with resource limits, sandboxing, and least privilege.

How to confirm the fix worked

Confirm the deployed ImageMagick version with commands such as `magick -version`, `convert -version`, or package-manager inventory, and verify it is 7.1.2-15 or later, 6.9.13-40 or later, or a vendor-patched equivalent. Check container images and application bundles, not only host packages. If mitigation is used, verify the PCD coder is disabled in ImageMagick policy.xml and that PCD input is rejected by upload and conversion paths. Run a safe functional test with normal supported image types to confirm processing still works, and optionally test that benign PCD files are blocked or handled only by patched binaries. Avoid running public proof-of-concept crash files in production; use staging or controlled scanners.

Typical attack path

1. Identify an application, API, or background service that processes user-supplied images with ImageMagick.
2. Determine whether PCD files are accepted directly or whether content sniffing can cause a crafted file to be handled by the PCD coder.
3. Craft a malformed PCD image that reaches the vulnerable DecodeImage loop.
4. Upload, email, submit, or otherwise deliver the crafted image to the target processing workflow.
5. Trigger ImageMagick decoding through thumbnail generation, metadata extraction, conversion, or validation.
6. Cause a decoder crash, failed job, service instability, or potentially limited one-byte heap data disclosure.

How to detect it

There are no known unique network indicators for this vulnerability, and exploitation may leave only application-level artifacts. Hunt for uploads, email attachments, or conversion jobs involving PCD / Photo CD files, especially shortly before ImageMagick worker crashes, HTTP 500 responses, failed thumbnail jobs, segmentation faults, core dumps, or container restarts. Review web access logs, object-storage access logs, application upload logs, queue/job logs, EDR process telemetry, crash reporting, systemd/journal logs, Kubernetes pod restart events, and core dump directories. Look for ImageMagick processes such as `magick`, `convert`, or `identify` handling `.pcd` files, crashes referencing the PCD coder, DecodeImage, heap-buffer-overflow, or out-of-bounds reads. If AddressSanitizer or hardened builds are used, search sanitizer reports for heap buffer over-read findings in ImageMagick PCD code. Treat isolated `.pcd` processing as suspicious in environments where Photo CD files are not expected.

• .pcd
• image/x-photo-cd
• Photo CD
• PCD
• coders/pcd.c
• DecodeImage
• heap-buffer-overflow
• heap-buffer-over-read
• out-of-bounds read
• AddressSanitizer
• magick
• convert
• identify
• core dumped
• segmentation fault

What your security team should do

• Inventory all ImageMagick installations, including containers, application dependencies, build images, background workers, and third-party conversion services.
• Prioritize upgrades for internet-facing upload, conversion, preview, CMS, ticketing, and file-ingestion workflows that process untrusted files.
• Upgrade to ImageMagick 7.1.2-15 or later, 6.9.13-40 or later, or vendor-patched packages.
• If patching is delayed, disable the PCD coder and block `.pcd` / Photo CD content at ingress where business use is not required.
• Review recent crashes, failed media-processing jobs, and uploads of uncommon image formats for evidence of attempted exploitation.
• Apply sandboxing, memory limits, timeouts, and queue isolation around ImageMagick to limit denial-of-service impact from malformed files.
• Track vendor advisories for downstream products that bundle ImageMagick, because the vulnerable library may be present even when ImageMagick is not installed as a standalone package.