CVE-2026-24485: ImageMagick PCD File DoS Vulnerability

CVE-2026-24485 Overview

CVE-2026-24485 is a Denial of Service vulnerability in ImageMagick, the widely-used open-source software for editing and manipulating digital images. The vulnerability exists in the DecodeImage() function within the PCD file format handler. When processing a maliciously crafted PCD file that lacks a valid Sync marker, the function enters an infinite loop while searching for the marker, causing the program to become unresponsive and continuously consume CPU resources, ultimately leading to system resource exhaustion.

Critical Impact

Attackers can craft malicious PCD image files that trigger an infinite loop in ImageMagick, causing complete CPU resource exhaustion and denial of service on systems processing untrusted images.

Affected Products

• ImageMagick versions prior to 7.1.2-15
• ImageMagick versions prior to 6.9.13-40
• Magick.NET versions prior to 14.10.3

Discovery Timeline

• 2026-02-24 - CVE CVE-2026-24485 published to NVD
• 2026-02-24 - Last updated in NVD database

Technical Details for CVE-2026-24485

Vulnerability Analysis

This vulnerability is classified as CWE-400 (Uncontrolled Resource Consumption), a common weakness that occurs when an application does not properly restrict the resources consumed by malicious input. In this case, the DecodeImage() function in coders/pcd.c attempts to locate a Sync marker within PCD image files. When processing a file that has been crafted without a valid Sync marker, the function continuously searches for the marker without any termination condition, causing an infinite loop.

The vulnerability can be exploited remotely without authentication. An attacker simply needs to convince a target system to process a malicious PCD file—this could occur through web applications that accept user-uploaded images, email attachments processed by automated systems, or any service that uses ImageMagick for image conversion or manipulation.

Root Cause

The root cause lies in the PCDGetBits macro within coders/pcd.c. The original implementation failed to check the return value of ReadBlob() when reading data from the image file. When the end of file is reached while searching for a Sync marker, ReadBlob() returns less than the expected bytes, but the macro continued looping indefinitely because this condition was never checked.

Attack Vector

The attack vector is network-based, requiring no privileges or user interaction. An attacker can exploit this vulnerability by:

1. Crafting a malicious PCD image file that omits or corrupts the Sync marker
2. Submitting the file to any service that uses ImageMagick for processing
3. The DecodeImage() function enters an infinite loop attempting to locate the missing Sync marker
4. CPU resources are consumed indefinitely until the process is manually terminated or the system becomes unresponsive

This is particularly dangerous for web applications, image processing pipelines, and cloud services that automatically process user-uploaded images.

#define IsSync(sum)  ((sum & 0xffffff00UL) == 0xfffffe00UL)
#define PCDGetBits(n) \
{  \
+  ssize_t \
+    byte_count = 0x800; \
+  \
   sum=(sum << n) & 0xffffffff; \
   bits-=n; \
   while (bits <= 24) \
   { \
     if (p >= (buffer+0x800)) \
       { \
-        (void) ReadBlob(image,0x800,buffer); \
+        byte_count=ReadBlob(image,0x800,buffer); \
+        if (byte_count != 0x800) \
+          break; \
         p=buffer; \
       } \
     sum|=(((unsigned int) (*p)) << (24-bits)); \
     bits+=8; \
     p++; \
   } \
+  if (byte_count != 0x800) \
+    break; \
}

  typedef struct PCDTable

Source: GitHub Commit Details

Detection Methods for CVE-2026-24485

Indicators of Compromise

• Abnormally high CPU utilization by ImageMagick processes (convert, identify, mogrify, or related binaries)
• ImageMagick processes that remain running indefinitely without completing
• System logs showing PCD file processing that never terminates
• Unusual volume of PCD file uploads or processing requests

Detection Strategies

• Monitor CPU usage patterns for ImageMagick processes and alert on sustained high utilization exceeding normal thresholds
• Implement file type validation to detect and quarantine suspicious PCD files before processing
• Set up process timeout monitoring to identify ImageMagick operations that exceed expected processing duration
• Deploy file integrity monitoring on ImageMagick binaries to ensure they are running patched versions

Monitoring Recommendations

• Configure resource limits (cgroups, ulimits) for ImageMagick processes to prevent complete system exhaustion
• Implement logging for all image processing operations including file types and processing duration
• Set up automated alerts for ImageMagick process CPU usage exceeding 90% for more than 30 seconds
• Monitor for patterns of failed or timed-out PCD file processing that may indicate exploitation attempts

How to Mitigate CVE-2026-24485

Immediate Actions Required

• Upgrade ImageMagick to version 7.1.2-15 or later (for 7.x branch) or 6.9.13-40 or later (for 6.x branch)
• Upgrade Magick.NET to version 14.10.3 or later if using the .NET wrapper
• Disable PCD format processing in ImageMagick policy.xml if PCD support is not required
• Implement process timeouts and resource limits for all ImageMagick operations

Patch Information

The vulnerability has been patched in ImageMagick versions 7.1.2-15 and 6.9.13-40. The fix adds proper validation of the ReadBlob() return value in the PCDGetBits macro. When the function reads fewer bytes than expected (indicating end-of-file or read error), the loop now properly terminates instead of continuing indefinitely.

For detailed patch information, see the GitHub Commit Details and the GitHub Security Advisory. Magick.NET users should refer to the Magick.NET Release Notes.

Workarounds

• Disable PCD coder entirely by adding a policy restriction in ImageMagick's policy.xml configuration file
• Implement strict timeouts for all ImageMagick processing operations at the application level
• Use input validation to reject or quarantine PCD files from untrusted sources
• Deploy resource isolation (containers, sandboxing) for ImageMagick processing to limit impact of exploitation

# Configuration example
# Add to /etc/ImageMagick-7/policy.xml or /etc/ImageMagick-6/policy.xml
# to disable PCD format processing as a workaround:

# Inside the <policymap> section, add:
# <policy domain="coder" rights="none" pattern="PCD" />

# Example command to verify policy is active:
identify -list policy | grep -i pcd

# Set process timeout for ImageMagick operations (example with timeout command):
timeout 60s convert input.pcd output.png