CVE-2026-56378 Overview
CVE-2026-56378 is a heap out-of-bounds read vulnerability in ImageMagick affecting versions prior to 7.1.2-15 and 6.x versions before 6.9.13-40. The flaw resides in the Photo CD (PCD) coder's DecodeImage loop. A crafted PCD file can trigger a one-byte heap out-of-bounds read during image decoding. Successful exploitation can cause denial of service and may disclose an adjacent heap byte. ImageMagick is widely embedded in web applications, image processing pipelines, and content management systems, expanding the potential attack surface. The vulnerability is categorized under [CWE-125] (Out-of-bounds Read).
Critical Impact
A crafted PCD file processed by a vulnerable ImageMagick instance triggers a one-byte heap out-of-bounds read, leading to denial of service and possible disclosure of an adjacent heap byte.
Affected Products
- ImageMagick versions prior to 7.1.2-15
- ImageMagick 6.x versions prior to 6.9.13-40
- Applications and services embedding vulnerable ImageMagick PCD coder
Discovery Timeline
- 2026-06-21 - CVE-2026-56378 published to NVD
- 2026-06-22 - Last updated in NVD database
Technical Details for CVE-2026-56378
Vulnerability Analysis
The vulnerability exists in the PCD coder's DecodeImage routine within ImageMagick. The decoder processes Kodak Photo CD image files using a Huffman-style decoding loop that reads bytes from an internal buffer. Under specific conditions triggered by a malformed PCD file, the loop reads one byte past the allocated heap buffer boundary.
The out-of-bounds access results in two practical outcomes. First, the read can land in unmapped memory, causing the process to crash and producing a denial-of-service condition. Second, when the adjacent byte is mapped, the value influences subsequent decoding logic and may leak through error messages, timing, or rendered output.
Because ImageMagick is frequently invoked server-side to process user-uploaded images, attackers can deliver the malicious PCD file remotely through any application that accepts image uploads and routes them to a vulnerable ImageMagick version.
Root Cause
The root cause is missing bounds validation in the PCD DecodeImage loop. The decoder advances its read pointer based on values derived from attacker-controlled file data without verifying that the pointer remains within the allocated buffer. A crafted byte sequence drives the loop to read one byte beyond the buffer end.
Attack Vector
The attack vector is network-based when ImageMagick processes untrusted PCD files received from remote sources. An attacker uploads or submits a crafted .pcd file to any service that invokes ImageMagick for conversion, thumbnailing, or validation. Exploitation requires no authentication or user interaction beyond standard file submission.
No verified public proof-of-concept code is available. Refer to the GitHub Security Advisory GHSA-wgxp-q8xq-wpp9 and the VulnCheck Security Advisory for technical details.
Detection Methods for CVE-2026-56378
Indicators of Compromise
- ImageMagick worker processes crashing with SIGSEGV or AddressSanitizer reports referencing DecodeImage in the PCD coder.
- Inbound uploads or processed files with the .pcd extension or PCD magic bytes from untrusted sources.
- Repeated short-lived convert, magick, or identify process terminations correlated with PCD input.
Detection Strategies
- Inventory all systems running ImageMagick and check installed versions against 7.1.2-15 and 6.9.13-40 baselines.
- Inspect application logs for ImageMagick error output referencing PCD decoding failures or abnormal exits.
- Apply file-type inspection at upload boundaries to identify PCD content regardless of file extension.
Monitoring Recommendations
- Monitor ImageMagick child process exit codes and crash dumps within image processing pipelines.
- Alert on unusual volumes of PCD file submissions to web upload endpoints.
- Track ImageMagick package versions across container images and host systems using software composition analysis.
How to Mitigate CVE-2026-56378
Immediate Actions Required
- Upgrade ImageMagick to version 7.1.2-15 or later, or 6.9.13-40 or later for the 6.x branch.
- Restrict or disable the PCD coder in ImageMagick policy configuration where PCD processing is not required.
- Audit upstream dependencies and container images that bundle older ImageMagick versions.
Patch Information
The ImageMagick project addressed the vulnerability in versions 7.1.2-15 and 6.9.13-40. Patch details and commit references are published in the GitHub Security Advisory GHSA-wgxp-q8xq-wpp9. Rebuild and redeploy applications and container images that statically link or bundle ImageMagick libraries.
Workarounds
- Disable the PCD coder in /etc/ImageMagick-7/policy.xml with a policy rule denying the PCD and PCDS coders.
- Sandbox ImageMagick execution using seccomp, AppArmor, or container isolation to limit the impact of a crash.
- Validate uploaded file types server-side and reject PCD files at the application layer when not needed.
# Configuration example: disable the PCD coder in ImageMagick policy.xml
# Add the following lines inside the <policymap> element
<policy domain="coder" rights="none" pattern="PCD" />
<policy domain="coder" rights="none" pattern="PCDS" />
# Verify the policy is applied
identify -list policy | grep -i pcd
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
