CVE-2026-45031: ImageMagick PSD DoS Vulnerability

CVE-2026-45031 Overview

CVE-2026-45031 is a resource policy bypass vulnerability in ImageMagick, the open-source software used for editing and manipulating digital images. A missing check in the Photoshop Document (PSD) decoder allows attackers to bypass the list-length resource policy when decoding a crafted PSD image. Other security limits still apply, which constrains the overall impact to availability. The flaw is classified under [CWE-400] (Uncontrolled Resource Consumption) and affects ImageMagick versions prior to 6.9.13-47 and 7.1.2-22. Maintainers patched the issue in both branches.

Critical Impact
Remote attackers can submit malicious PSD files that bypass the list-length policy guard, leading to excessive resource consumption and partial availability impact on systems that process untrusted images.

Affected Products

ImageMagick versions prior to 6.9.13-47 (6.x branch)
ImageMagick versions prior to 7.1.2-22 (7.x branch)
Applications and services embedding vulnerable ImageMagick builds for PSD processing

Discovery Timeline

2026-06-10 - CVE-2026-45031 published to NVD
2026-06-10 - Last updated in NVD database

Technical Details for CVE-2026-45031

Vulnerability Analysis

ImageMagick enforces resource policies through policy.xml, which lets operators bound memory, map size, area, and the list-length limit applied to image lists. The PSD decoder fails to validate list lengths against this policy during decoding. An attacker who supplies a crafted PSD file can therefore allocate or iterate structures whose size exceeds the configured list-length ceiling. The bypass undermines a control intended to mitigate denial-of-service from oversized image lists. Remaining policy controls, such as memory and area limits, continue to apply, which contains the worst-case impact to availability rather than confidentiality or integrity.

Root Cause

The root cause is a missing length check in the PSD decoder path. The decoder reads list-related metadata from the input file and proceeds without comparing the value to the list-length policy. This is an input validation failure that maps to [CWE-400] because attacker-controlled inputs drive unbounded resource consumption. The fix in 6.9.13-47 and 7.1.2-22 adds the missing policy check to the PSD parsing routine.

Attack Vector

The vulnerability is reachable over the network wherever ImageMagick decodes untrusted PSD content. Web upload endpoints, thumbnail generators, document pipelines, and image conversion APIs are common exposure points. The attacker requires no privileges and no user interaction beyond delivering the malicious file to the processing service. No public proof-of-concept or in-the-wild exploitation has been reported. See the GitHub Security Advisory GHSA-cwpj-h54c-xjpx for additional context on the fix.

Detection Methods for CVE-2026-45031

Indicators of Compromise

ImageMagick worker processes consuming abnormal CPU or memory while decoding PSD inputs.
Repeated submission of .psd files from a single source to image processing endpoints.
convert, magick, or identify processes terminating with resource-limit errors after PSD inputs.

Detection Strategies

Inventory hosts running ImageMagick and compare installed versions against 6.9.13-47 and 7.1.2-22 to surface vulnerable builds.
Inspect policy.xml to confirm list-length is configured, then alert on PSD decode operations that exceed expected memory or runtime baselines.
Capture stderr from ImageMagick invocations and flag policy-related warnings tied to PSD files.

Monitoring Recommendations

Monitor file upload endpoints for spikes in PSD submissions, particularly oversized files from unauthenticated sources.
Track per-process resource ceilings on image conversion workers and alert on sustained saturation.
Forward web application and container logs to a centralized analytics platform for correlation across upload, decode, and crash events.

How to Mitigate CVE-2026-45031

Immediate Actions Required

Upgrade ImageMagick to version 6.9.13-47 or 7.1.2-22 or later across all hosts, containers, and base images.
Audit application dependencies and rebuild downstream packages that bundle ImageMagick libraries.
Restrict PSD uploads to authenticated users where business requirements allow, until patching is complete.

Patch Information

The fix is available in ImageMagick 6.9.13-47 and 7.1.2-22. Both releases add the missing list-length enforcement to the PSD decoder. Operators should pull the patched releases from official sources and verify the version reported by magick -version. Distribution maintainers are tracking the fix per the GitHub Security Advisory GHSA-cwpj-h54c-xjpx.

Workarounds

Disable the PSD coder in policy.xml if PSD support is not required for the workload.
Tighten remaining resource policies, including memory, map, area, and time, to bound impact when patching is delayed.
Process untrusted images inside isolated containers with strict CPU and memory cgroup limits.

bash

# Configuration example: disable the PSD coder in policy.xml
# File: /etc/ImageMagick-7/policy.xml
<policymap>
  <policy domain="coder" rights="none" pattern="PSD" />
  <policy domain="resource" name="list-length" value="128" />
  <policy domain="resource" name="memory" value="256MiB" />
  <policy domain="resource" name="map" value="512MiB" />
  <policy domain="resource" name="area" value="128MB" />
  <policy domain="resource" name="time" value="30" />
</policymap>