Vulnerability GHSA-wgxp-q8xq-wpp9

Low Risk
LOW RISK
CVSS Score: 3.7
Score Range: < 4.0
Low severity vulnerabilities (CVSS < 4.0). Hygiene issues that can accumulate but pose lower immediate risk.
8 months ago
February 25, 2026 at 07:12 PM UTC
ImageMagick: Malicious PCD files trigger 1‑byte heap Out-of-bounds Read and DoS
6.8.8.1001 and 6.8.9.1 and 6.8.9.2 and 6.8.9.101 and 6.8.9.401 and 6.8.9.501 and 6.8.9.601 and 7.0.0.1 and 7.0.0.2 and 7.0.0.3 and 7.0.0.4 and 7.0.0.5 and 7.0.0.6 and 7.0.0.7 and 7.0.0.8 and 7.0.0.9 and 7.0.0.10 and 7.0.0.11 and 7.0.0.12 and 7.0.0.13 and 7.0.0.14 and 7.0.0.15 and 7.0.0.16 and 7.0.0.17 and 7.0.0.18 and 7.0.0.19 and 7.0.0.20 and 7.0.0.21 and 7.0.0.22 and 7.0.0.101 and 7.0.0.102 and 7.0.0.103 and 7.0.0.104 and 7.0.1 and 7.0.1.100 and 7.0.1.101 and 7.0.1.500 and 7.0.2.100 and 7.0.2.400 and 7.0.2.600 and 7.0.2.900 and 7.0.2.901 and 7.0.2.902 and 7.0.3 and 7.0.3.1 and 7.0.3.300 and 7.0.3.500 and 7.0.3.501 and 7.0.3.502 and 7.0.3.901 and 7.0.3.902 and 7.0.4.100 and 7.0.4.400 and 7.0.4.700 and 7.0.4.701 and 7.0.5.500 and 7.0.5.501 and 7.0.5.502 and 7.0.5.800 and 7.0.5.900 and 7.0.6 and 7.0.6.100 and 7.0.6.101 and 7.0.6.102 and 7.0.6.600 and 7.0.6.601 and 7.0.6.1000 and 7.0.6.1001 and 7.0.6.1002 and 7.0.7 and 7.0.7.300 and 7.0.7.700 and 7.0.7.900 and 7.1.0 - 7.5.0 and 7.5.0.1 and 7.6.0 and 7.6.0.1 and 7.7.0 - 7.9.0 and 7.9.0.1 and 7.9.0.2 and 7.9.1 - 7.14.0 and 7.14.0.1 and 7.14.0.2 and 7.14.0.3 and 7.14.1 - 7.15.0 and 7.15.0.1 and 7.15.1 - 7.17.0 and 7.17.0.1 and 7.18.0 - 7.19.0 and 7.19.0.1 and 7.20.0 and 7.20.0.1 and 7.21.0 - 7.22.2 and 7.22.2.1 and 7.22.2.2 and 7.22.3 - 7.23.2 and 7.23.2.1 and 7.23.3 - 14.10.2
6.8.8.1001 and 6.8.9.1 and 6.8.9.2 and 6.8.9.101 and 6.8.9.401 and 6.8.9.501 and 6.8.9.601 and 7.0.0.1 and 7.0.0.2 and 7.0.0.3 and 7.0.0.4 and 7.0.0.5 and 7.0.0.6 and 7.0.0.7 and 7.0.0.8 and 7.0.0.9 and 7.0.0.10 and 7.0.0.11 and 7.0.0.12 and 7.0.0.13 and 7.0.0.14 and 7.0.0.15 and 7.0.0.16 and 7.0.0.17 and 7.0.0.18 and 7.0.0.19 and 7.0.0.20 and 7.0.0.21 and 7.0.0.22 and 7.0.0.101 and 7.0.0.102 and 7.0.0.103 and 7.0.0.104 and 7.0.1 and 7.0.1.100 and 7.0.1.101 and 7.0.1.500 and 7.0.2.100 and 7.0.2.400 and 7.0.2.600 and 7.0.2.900 and 7.0.2.901 and 7.0.2.902 and 7.0.3 and 7.0.3.1 and 7.0.3.300 and 7.0.3.500 and 7.0.3.501 and 7.0.3.502 and 7.0.3.901 and 7.0.3.902 and 7.0.4.100 and 7.0.4.400 and 7.0.4.700 and 7.0.4.701 and 7.0.5.500 and 7.0.5.501 and 7.0.5.502 and 7.0.5.800 and 7.0.5.900 and 7.0.6 and 7.0.6.100 and 7.0.6.101 and 7.0.6.102 and 7.0.6.600 and 7.0.6.601 and 7.0.6.1000 and 7.0.6.1001 and 7.0.6.1002 and 7.0.7 and 7.0.7.300 and 7.0.7.700 and 7.0.7.900 and 7.1.0 - 7.5.0 and 7.5.0.1 and 7.6.0 and 7.6.0.1 and 7.7.0 - 7.9.0 and 7.9.0.1 and 7.9.0.2 and 7.9.1 - 7.14.0 and 7.14.0.1 and 7.14.0.2 and 7.14.0.3 and 7.14.1 - 7.15.0 and 7.15.0.1 and 7.15.1 - 7.17.0 and 7.17.0.1 and 7.18.0 - 7.19.0 and 7.19.0.1 and 7.20.0 and 7.20.0.1 and 7.21.0 - 7.22.2 and 7.22.2.1 and 7.22.2.2 and 7.22.3 - 7.23.2 and 7.23.2.1 and 7.23.3 - 14.10.2

Summary

ImageMagick: Malicious PCD files trigger 1‑byte heap Out-of-bounds Read and DoS

Details

The PCD coder’s DecodeImage loop allows a crafted PCD file to trigger a 1‑byte heap out-of-bounds read when decoding an image (Denial of service) and potential disclosure of adjacent heap byte.

Timeline

Published
8 months ago
February 25, 2026 at 07:12 PM UTC
Fixed (14.10.3)
8 months ago
February 23, 2026 at 08:38 PM UTC
Fixed (14.10.3)
8 months ago
February 23, 2026 at 08:38 PM UTC
Fixed (14.10.3)
8 months ago
February 23, 2026 at 08:38 PM UTC
Fixed (14.10.3)
8 months ago
February 23, 2026 at 08:38 PM UTC
Fixed (14.10.3)
8 months ago
February 23, 2026 at 08:38 PM UTC
Fixed (14.10.3)
8 months ago
February 23, 2026 at 08:38 PM UTC
Fixed (14.10.3)
8 months ago
February 23, 2026 at 08:38 PM UTC
Fixed (14.10.3)
8 months ago
February 23, 2026 at 08:38 PM UTC
Fixed (14.10.3)
8 months ago
February 23, 2026 at 08:38 PM UTC
Fixed (14.10.3)
8 months ago
February 23, 2026 at 08:38 PM UTC
Fixed (14.10.3)
8 months ago
February 23, 2026 at 08:38 PM UTC
Fixed (14.10.3)
8 months ago
February 23, 2026 at 08:38 PM UTC
Fixed (14.10.3)
8 months ago
February 23, 2026 at 08:38 PM UTC
Fixed (14.10.3)
8 months ago
February 23, 2026 at 08:38 PM UTC
Fixed (14.10.3)
8 months ago
February 23, 2026 at 08:38 PM UTC
Fixed (14.10.3)
8 months ago
February 23, 2026 at 08:38 PM UTC
Fixed (14.10.3)
8 months ago
February 23, 2026 at 08:38 PM UTC
Fixed (14.10.3)
8 months ago
February 23, 2026 at 08:39 PM UTC
Last Modified
2 hours ago
November 06, 2026 at 06:15 PM UTC