CVE-2026-56378
Received Received - Intake
Heap Out-of-Bounds Read in ImageMagick

Publication date: 2026-06-21

Last updated on: 2026-06-21

Assigner: VulnCheck

Description
ImageMagick before 7.1.2-15 (and 6.x before 6.9.13-40) contains a heap out-of-bounds read in the PCD coder's DecodeImage loop. A crafted PCD file can trigger a one-byte heap out-of-bounds read during image decoding, resulting in denial of service and potential disclosure of an adjacent heap byte.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-06-21
Last Modified
2026-06-21
Generated
2026-06-21
AI Q&A
2026-06-21
EPSS Evaluated
N/A
NVD
CVE-2026-56378
EUVD
EUVD-2026-38174
Affected Vendors & Products
Showing 2 associated CPEs
Vendor Product Version / Range
imagemagick imagemagick to 7.1.2-15 (exc)
imagemagick imagemagick to 6.9.13-40 (exc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-125 The product reads data past the end, or before the beginning, of the intended buffer.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

CVE-2026-56378 is a vulnerability in ImageMagick versions before 7.1.2-15 and 6.x before 6.9.13-40. It involves a one-byte heap out-of-bounds read in the PCD coder's DecodeImage loop. This means that when ImageMagick processes a specially crafted PCD image file, it can read memory beyond the allocated heap buffer by one byte.

This out-of-bounds read can cause a denial of service (crash or hang) and may also lead to the disclosure of an adjacent byte in memory, potentially leaking sensitive information.

Compliance Impact

The provided information does not specify any direct impact of this vulnerability on compliance with common standards and regulations such as GDPR or HIPAA.

Detection Guidance

This vulnerability can be detected by identifying the presence of vulnerable ImageMagick versions on your system. Specifically, versions before 7.1.2-15 and 6.x before 6.9.13-40 are affected.

To check the installed ImageMagick version, you can run the following command on your system:

  • magick --version

If the version is earlier than 7.1.2-15 or 6.9.13-40, your system is vulnerable.

Additionally, monitoring network traffic for suspicious or crafted PCD image files being processed by ImageMagick could help detect exploitation attempts, but no specific detection commands or signatures are provided in the available resources.

Impact Analysis

The vulnerability can impact you by causing denial of service when ImageMagick attempts to decode a maliciously crafted PCD file, potentially crashing the application or service using ImageMagick.

Additionally, there is a risk of information disclosure due to the one-byte out-of-bounds read, which might leak adjacent heap memory content. However, the impact on confidentiality, integrity, and availability is considered low.

Mitigation Strategies

To mitigate this vulnerability, you should upgrade ImageMagick to a patched version.

  • Upgrade to ImageMagick version 7.1.2-15 or later.
  • For 6.x versions, upgrade to 6.9.13-40 or later.
Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-56378. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart