CVE-2026-56378
Magick.NET: ImageMagick: Denial of Service and Information Disclosure via crafted PCD file
Severity
ModerateRed Hat Product Security
CVSS 3.1
Review impact separately from score.
Published · June 21, 2026
Updated · August 18, 2026
Description
A vulnerability in ImageMagick allows attackers to crash the application or expose system data if a maliciously crafted Picture CD (PCD) file is processed.
Statement
A flaw in ImageMagick's file processing puts applications at risk of service outages or minor data leaks. This is only triggered if the system is forced to process a corrupted, attacker-supplied Picture CD (PCD) file.
CVSS score applicability
The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.
Mitigation
Avoid processing untrusted PCD (Picture CD) image files with ImageMagick. Applications that utilize ImageMagick for image processing should ensure that input files originate from trusted sources or are thoroughly validated.
CVSS / CWE
CVSS 3.1 · 4.8CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L
CWE-125 · Out-of-bounds Read