CVE Database›Document archive›CVE-2026-56378

CVE-2026-56378

Magick.NET: ImageMagick: Denial of Service and Information Disclosure via crafted PCD file

Loading…

Severity

Moderate

Red Hat Product Security

4.8

CVSS 3.1

Review impact separately from score.

Published · June 21, 2026

Updated · August 18, 2026

Description

A vulnerability in ImageMagick allows attackers to crash the application or expose system data if a maliciously crafted Picture CD (PCD) file is processed.

Statement

A flaw in ImageMagick's file processing puts applications at risk of service outages or minor data leaks. This is only triggered if the system is forced to process a corrupted, attacker-supplied Picture CD (PCD) file.

CVSS score applicability

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation

Avoid processing untrusted PCD (Picture CD) image files with ImageMagick. Applications that utilize ImageMagick for image processing should ensure that input files originate from trusted sources or are thoroughly validated.

CVSS / CWE

CVSS 3.1 · 4.8
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L

CWE-125 · Out-of-bounds Read