CVE-2026-26284

A flaw was found in ImageMagick, a free and open-source software used for editing and manipulating digital images. When processing Huffman-coded data from Photo CD (PCD) files, the image decoder contains an incorrect initialization that could lead to an out-of-bounds read. This vulnerability could allow a remote attacker to cause information disclosure or a denial of service.

This MODERATE impact vulnerability in ImageMagick involves a heap overflow in the PCD (Photo CD) decoder, leading to an out-of-bounds read when processing Huffman-coded data. An attacker could exploit this by providing a specially crafted PCD file. Red Hat Enterprise Linux 6 ELS and 7 ELS are affected.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this issue, restrict ImageMagick's ability to process PCD (Photo CD) files by disabling the PCD coder. This can be done by adding or modifying a policy entry in the ImageMagick configuration file, typically located at /etc/ImageMagick-X/policy.xml (where 'X' is the ImageMagick version). Add the following line within the <policymap> tags:

<policy domain="coder" rights="none" pattern="PCD" />

Applications utilizing ImageMagick may require a restart for this change to take effect. This action will prevent ImageMagick from processing PCD files, which may affect functionality dependent on this format.