CVE-2026-56367: ImageMagick Information Disclosure Flaw

CVE-2026-56367 Overview

CVE-2026-56367 is an integer overflow vulnerability in ImageMagick affecting the Photoshop Big (PSB) format RLE decoding path. The flaw resides in the ReadPSDChannelRLE function within coders/psd.c. On 32-bit builds, the overflow leads to a heap out-of-bounds read [CWE-125]. Processing a crafted PSB file can disclose adjacent heap memory or crash the process. The vulnerability affects ImageMagick versions before 7.1.2-15 and 6.9.x versions before 6.9.13-40. Any service that accepts user-supplied images and converts them through ImageMagick is exposed.

Critical Impact
Attackers can trigger information disclosure or denial of service by submitting a malicious PSB (PSD v2) file to any application that processes images with a vulnerable 32-bit ImageMagick build.

Affected Products

ImageMagick versions before 7.1.2-15
ImageMagick 6.9.x versions before 6.9.13-40
32-bit builds processing PSB (PSD v2) files

Discovery Timeline

2026-06-21 - CVE-2026-56367 published to NVD
2026-06-22 - Last updated in NVD database

Technical Details for CVE-2026-56367

Vulnerability Analysis

The vulnerability lives in ReadPSDChannelRLE, the function that decodes Run-Length Encoded (RLE) channel data inside PSB files. PSB is the large-document variant of the Photoshop Document (PSD) format and uses wider integer fields for dimensions and offsets. The decoder computes buffer sizes and offsets using arithmetic that overflows on 32-bit platforms when PSB dimension fields are large. The truncated result causes the decoder to read past the bounds of the allocated heap buffer. The out-of-bounds read either returns adjacent heap memory to the caller or triggers a fault that terminates the process.

Root Cause

The root cause is unchecked integer arithmetic during RLE row and channel size calculations in coders/psd.c. PSB allows 64-bit length fields, but the decoder reduces them through 32-bit intermediates on 32-bit builds. When the product of width, height, or row count exceeds UINT32_MAX, the value wraps. The smaller computed length is used to allocate or index a buffer that is then read with the attacker-controlled original length.

Attack Vector

Exploitation requires an attacker to deliver a crafted PSB file to a target that parses it with ImageMagick. Common paths include image upload endpoints, document conversion services, thumbnail generators, and mail or chat preview pipelines. No authentication is required when the target service accepts anonymous uploads. The high attack complexity reflects the need to align heap layout and dimension fields to produce useful disclosure rather than a simple crash. Refer to the GitHub Security Advisory and the VulnCheck Advisory for additional technical context.

Detection Methods for CVE-2026-56367

Indicators of Compromise

PSB or PSD files uploaded with unusually large width, height, or channel dimension fields that suggest forced integer overflow.
Repeated ImageMagick process crashes or SIGSEGV events in convert, magick, or identify workers handling user-supplied images.
Unexpected memory contents echoed back through converted image outputs or error messages.

Detection Strategies

Inventory all hosts running ImageMagick and compare installed versions against 7.1.2-15 and 6.9.13-40, with priority on 32-bit builds.
Hunt for PSB file uploads (.psb extension or 8BPB magic bytes) crossing perimeter web application firewalls and file ingestion services.
Monitor application logs for ImageMagick errors such as UnableToReadImageData or CorruptImage originating from PSD coder paths.

Monitoring Recommendations

Alert on repeated crashes of image processing worker processes that correlate with inbound PSB or PSD content.
Capture and review samples of malformed PSB files for offline analysis using a sandbox build with AddressSanitizer enabled.
Track outbound responses from image conversion services for anomalous size or binary content that could indicate leaked heap data.

How to Mitigate CVE-2026-56367

Immediate Actions Required

Upgrade ImageMagick to version 7.1.2-15 or later, or 6.9.13-40 or later for the 6.9.x branch.
Migrate image processing workloads off 32-bit ImageMagick builds wherever feasible, since the out-of-bounds read is specific to 32-bit address arithmetic.
Restrict accepted upload formats and reject PSB files at the application or WAF layer until patches are deployed.

Patch Information

The ImageMagick project has released fixed versions 7.1.2-15 and 6.9.13-40 that correct the integer arithmetic in ReadPSDChannelRLE. Distribution maintainers are publishing backported packages for supported Linux releases. Verify the installed version with magick -version or convert -version after patching, and confirm the PSD coder no longer crashes on known proof-of-concept samples.

Workarounds

Disable the PSD and PSB coders in policy.xml by adding a <policy domain="coder" rights="none" pattern="PSD,PSB" /> rule until patches are applied.
Enforce strict resource limits in ImageMagick policy.xml such as width, height, and memory ceilings to constrain abusive dimension fields.
Sandbox the image conversion process with seccomp, AppArmor, or a container with no network egress to limit the impact of any disclosed memory.

bash

# Configuration example: disable PSD/PSB coders in /etc/ImageMagick-7/policy.xml
<policymap>
  <policy domain="coder" rights="none" pattern="PSD" />
  <policy domain="coder" rights="none" pattern="PSB" />
  <policy domain="resource" name="width" value="16KP" />
  <policy domain="resource" name="height" value="16KP" />
  <policy domain="resource" name="memory" value="256MiB" />
</policymap>