Vulnerability GHSA-wgxp-q8xq-wpp9
Low Risk
LOW RISK
CVSS Score: 3.7
Score Range: < 4.0
Low severity vulnerabilities (CVSS < 4.0). Hygiene issues that can accumulate but pose lower immediate risk.
8 months ago
February 25, 2026 at 07:12 PM UTC
ImageMagick: Malicious PCD files trigger 1‑byte heap Out-of-bounds Read and DoS
6.8.8.1001 and 6.8.9.1 and 6.8.9.2 and 6.8.9.101 and 6.8.9.401 and 6.8.9.501 and 6.8.9.601 and 7.0.0.1 and 7.0.0.2 and 7.0.0.3 and 7.0.0.4 and 7.0.0.5 and 7.0.0.6 and 7.0.0.7 and 7.0.0.8 and 7.0.0.9 and 7.0.0.10 and 7.0.0.11 and 7.0.0.12 and 7.0.0.13 and 7.0.0.14 and 7.0.0.15 and 7.0.0.16 and 7.0.0.17 and 7.0.0.18 and 7.0.0.19 and 7.0.0.20 and 7.0.0.21 and 7.0.0.22 and 7.0.0.101 and 7.0.0.102 and 7.0.0.103 and 7.0.0.104 and 7.0.1 and 7.0.1.100 and 7.0.1.101 and 7.0.1.500 and 7.0.2.100 and 7.0.2.400 and 7.0.2.600 and 7.0.2.900 and 7.0.2.901 and 7.0.2.902 and 7.0.3 and 7.0.3.1 and 7.0.3.300 and 7.0.3.500 and 7.0.3.501 and 7.0.3.502 and 7.0.3.901 and 7.0.3.902 and 7.0.4.100 and 7.0.4.400 and 7.0.4.700 and 7.0.4.701 and 7.0.5.500 and 7.0.5.501 and 7.0.5.502 and 7.0.5.800 and 7.0.5.900 and 7.0.6 and 7.0.6.100 and 7.0.6.101 and 7.0.6.102 and 7.0.6.600 and 7.0.6.601 and 7.0.6.1000 and 7.0.6.1001 and 7.0.6.1002 and 7.0.7 and 7.0.7.300 and 7.0.7.700 and 7.0.7.900 and 7.1.0 - 7.5.0 and 7.5.0.1 and 7.6.0 and 7.6.0.1 and 7.7.0 - 7.9.0 and 7.9.0.1 and 7.9.0.2 and 7.9.1 - 7.14.0 and 7.14.0.1 and 7.14.0.2 and 7.14.0.3 and 7.14.1 - 7.15.0 and 7.15.0.1 and 7.15.1 - 7.17.0 and 7.17.0.1 and 7.18.0 - 7.19.0 and 7.19.0.1 and 7.20.0 and 7.20.0.1 and 7.21.0 - 7.22.2 and 7.22.2.1 and 7.22.2.2 and 7.22.3 - 7.23.2 and 7.23.2.1 and 7.23.3 - 14.10.2
6.8.8.1001 and 6.8.9.1 and 6.8.9.2 and 6.8.9.101 and 6.8.9.401 and 6.8.9.501 and 6.8.9.601 and 7.0.0.1 and 7.0.0.2 and 7.0.0.3 and 7.0.0.4 and 7.0.0.5 and 7.0.0.6 and 7.0.0.7 and 7.0.0.8 and 7.0.0.9 and 7.0.0.10 and 7.0.0.11 and 7.0.0.12 and 7.0.0.13 and 7.0.0.14 and 7.0.0.15 and 7.0.0.16 and 7.0.0.17 and 7.0.0.18 and 7.0.0.19 and 7.0.0.20 and 7.0.0.21 and 7.0.0.22 and 7.0.0.101 and 7.0.0.102 and 7.0.0.103 and 7.0.0.104 and 7.0.1 and 7.0.1.100 and 7.0.1.101 and 7.0.1.500 and 7.0.2.100 and 7.0.2.400 and 7.0.2.600 and 7.0.2.900 and 7.0.2.901 and 7.0.2.902 and 7.0.3 and 7.0.3.1 and 7.0.3.300 and 7.0.3.500 and 7.0.3.501 and 7.0.3.502 and 7.0.3.901 and 7.0.3.902 and 7.0.4.100 and 7.0.4.400 and 7.0.4.700 and 7.0.4.701 and 7.0.5.500 and 7.0.5.501 and 7.0.5.502 and 7.0.5.800 and 7.0.5.900 and 7.0.6 and 7.0.6.100 and 7.0.6.101 and 7.0.6.102 and 7.0.6.600 and 7.0.6.601 and 7.0.6.1000 and 7.0.6.1001 and 7.0.6.1002 and 7.0.7 and 7.0.7.300 and 7.0.7.700 and 7.0.7.900 and 7.1.0 - 7.5.0 and 7.5.0.1 and 7.6.0 and 7.6.0.1 and 7.7.0 - 7.9.0 and 7.9.0.1 and 7.9.0.2 and 7.9.1 - 7.14.0 and 7.14.0.1 and 7.14.0.2 and 7.14.0.3 and 7.14.1 - 7.15.0 and 7.15.0.1 and 7.15.1 - 7.17.0 and 7.17.0.1 and 7.18.0 - 7.19.0 and 7.19.0.1 and 7.20.0 and 7.20.0.1 and 7.21.0 - 7.22.2 and 7.22.2.1 and 7.22.2.2 and 7.22.3 - 7.23.2 and 7.23.2.1 and 7.23.3 - 14.10.2
Summary
ImageMagick: Malicious PCD files trigger 1‑byte heap Out-of-bounds Read and DoS
Details
The PCD coder’s DecodeImage loop allows a crafted PCD file to trigger a 1‑byte heap out-of-bounds read when decoding an image (Denial of service) and potential disclosure of adjacent heap byte.
Related Vulnerabilities
Other vulnerabilities affecting the same packages
Low Risk
2 months ago
ImageMagick: Memory Leak when providing invalid options to the cli
8.6.0 - 14.14.0 GHSA-cvhv-g4rq-3hmw
8.6.0 - 14.14.0 GHSA-cvhv-g4rq-3hmw
Low Risk
2 months ago
ImageMagick: Memory Leak when providing invalid options to the cli
8.6.0 - 14.14.0 GHSA-cvhv-g4rq-3hmw
8.6.0 - 14.14.0 GHSA-cvhv-g4rq-3hmw
Low Risk
2 months ago
ImageMagick: Memory Leak when providing invalid options to the cli
8.6.0 - 14.14.0 GHSA-cvhv-g4rq-3hmw
8.6.0 - 14.14.0 GHSA-cvhv-g4rq-3hmw
Low Risk
2 months ago
ImageMagick: Memory Leak when providing invalid options to the cli
8.6.0 - 14.14.0 GHSA-cvhv-g4rq-3hmw
8.6.0 - 14.14.0 GHSA-cvhv-g4rq-3hmw
Low Risk
2 months ago
ImageMagick: Memory Leak when providing invalid options to the cli
8.6.0 - 14.14.0 GHSA-cvhv-g4rq-3hmw
8.6.0 - 14.14.0 GHSA-cvhv-g4rq-3hmw
Impacted packages
-
magick.net-q16-anycpu
-
magick.net-q16-arm64
-
magick.net-q16-hdri-anycpu
-
magick.net-q16-hdri-arm64
-
magick.net-q16-hdri-openmp-arm64
-
magick.net-q16-hdri-openmp-x64
-
magick.net-q16-hdri-x64
-
magick.net-q16-hdri-x86
-
magick.net-q16-openmp-arm64
-
magick.net-q16-openmp-x64
-
magick.net-q16-openmp-x86
-
magick.net-q16-x64
-
magick.net-q16-x86
-
magick.net-q8-anycpu
-
magick.net-q8-arm64
-
magick.net-q8-openmp-arm64
-
magick.net-q8-openmp-x64
-
magick.net-q8-x64
-
magick.net-q8-x86
Timeline
Published
8 months ago
February 25, 2026 at 07:12 PM UTC
Fixed (14.10.3)
8 months ago
February 23, 2026 at 08:38 PM UTC
Fixed (14.10.3)
8 months ago
February 23, 2026 at 08:38 PM UTC
Fixed (14.10.3)
8 months ago
February 23, 2026 at 08:38 PM UTC
Fixed (14.10.3)
8 months ago
February 23, 2026 at 08:38 PM UTC
Fixed (14.10.3)
8 months ago
February 23, 2026 at 08:38 PM UTC
Fixed (14.10.3)
8 months ago
February 23, 2026 at 08:38 PM UTC
Fixed (14.10.3)
8 months ago
February 23, 2026 at 08:38 PM UTC
Fixed (14.10.3)
8 months ago
February 23, 2026 at 08:38 PM UTC
Fixed (14.10.3)
8 months ago
February 23, 2026 at 08:38 PM UTC
Fixed (14.10.3)
8 months ago
February 23, 2026 at 08:38 PM UTC
Fixed (14.10.3)
8 months ago
February 23, 2026 at 08:38 PM UTC
Fixed (14.10.3)
8 months ago
February 23, 2026 at 08:38 PM UTC
Fixed (14.10.3)
8 months ago
February 23, 2026 at 08:38 PM UTC
Fixed (14.10.3)
8 months ago
February 23, 2026 at 08:38 PM UTC
Fixed (14.10.3)
8 months ago
February 23, 2026 at 08:38 PM UTC
Fixed (14.10.3)
8 months ago
February 23, 2026 at 08:38 PM UTC
Fixed (14.10.3)
8 months ago
February 23, 2026 at 08:38 PM UTC
Fixed (14.10.3)
8 months ago
February 23, 2026 at 08:39 PM UTC
Last Modified
2 hours ago
November 06, 2026 at 06:15 PM UTC