Read the docs
TI-2026-66254 Aliases GHSA-wgxp-q8xq-wpp9

ImageMagick: Malicious PCD files trigger 1‑byte heap Out-of-bounds Read and DoS

Priority LOW 38CWE-125Published · Updated

Key facts

Attack vector
—
Privileges required
—
User interaction
—
Attack complexity
—
Impact type
—
Confidentiality · integrity · availability
—
Fix status
Fixed

No CVSS vector from any source. Fix status from GitHub.

Summary

The PCD coder’s DecodeImage loop allows a crafted PCD file to trigger a 1‑byte heap out-of-bounds read when decoding an image (Denial of service) and potential disclosure of adjacent heap byte.

Why it matters now

Fix Fixed Magick.NET-Q16-AnyCPU (NuGet): 14.10.3Magick.NET-Q16-HDRI-AnyCPU (NuGet): 14.10.3+17 more products

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
—Magick.NET-Q16-AnyCPU (NuGet)before 14.10.314.10.3Patch availableGHSA-wgxp-q8xq-wpp9
—Magick.NET-Q16-HDRI-AnyCPU (NuGet)before 14.10.314.10.3Patch availableGHSA-wgxp-q8xq-wpp9
—Magick.NET-Q16-HDRI-OpenMP-arm64 (NuGet)before 14.10.314.10.3Patch availableGHSA-wgxp-q8xq-wpp9
—Magick.NET-Q16-HDRI-OpenMP-x64 (NuGet)before 14.10.314.10.3Patch availableGHSA-wgxp-q8xq-wpp9
—Magick.NET-Q16-HDRI-arm64 (NuGet)before 14.10.314.10.3Patch availableGHSA-wgxp-q8xq-wpp9
—Magick.NET-Q16-HDRI-x64 (NuGet)before 14.10.314.10.3Patch availableGHSA-wgxp-q8xq-wpp9
—Magick.NET-Q16-HDRI-x86 (NuGet)before 14.10.314.10.3Patch availableGHSA-wgxp-q8xq-wpp9
—Magick.NET-Q16-OpenMP-arm64 (NuGet)before 14.10.314.10.3Patch availableGHSA-wgxp-q8xq-wpp9
—Magick.NET-Q16-OpenMP-x64 (NuGet)before 14.10.314.10.3Patch availableGHSA-wgxp-q8xq-wpp9
—Magick.NET-Q16-OpenMP-x86 (NuGet)before 14.10.314.10.3Patch availableGHSA-wgxp-q8xq-wpp9
—Magick.NET-Q16-arm64 (NuGet)before 14.10.314.10.3Patch availableGHSA-wgxp-q8xq-wpp9
—Magick.NET-Q16-x64 (NuGet)before 14.10.314.10.3Patch availableGHSA-wgxp-q8xq-wpp9
—Magick.NET-Q16-x86 (NuGet)before 14.10.314.10.3Patch availableGHSA-wgxp-q8xq-wpp9
—Magick.NET-Q8-AnyCPU (NuGet)before 14.10.314.10.3Patch availableGHSA-wgxp-q8xq-wpp9
—Magick.NET-Q8-OpenMP-arm64 (NuGet)before 14.10.314.10.3Patch availableGHSA-wgxp-q8xq-wpp9
—Magick.NET-Q8-OpenMP-x64 (NuGet)before 14.10.314.10.3Patch availableGHSA-wgxp-q8xq-wpp9
—Magick.NET-Q8-arm64 (NuGet)before 14.10.314.10.3Patch availableGHSA-wgxp-q8xq-wpp9
—Magick.NET-Q8-x64 (NuGet)before 14.10.314.10.3Patch availableGHSA-wgxp-q8xq-wpp9
—Magick.NET-Q8-x86 (NuGet)before 14.10.314.10.3Patch availableGHSA-wgxp-q8xq-wpp9
  • Magick.NET-Q16-AnyCPU (NuGet) Vendor— Affected before 14.10.3 Fixed in 14.10.3 Patch available GHSA-wgxp-q8xq-wpp9
  • Magick.NET-Q16-HDRI-AnyCPU (NuGet) Vendor— Affected before 14.10.3 Fixed in 14.10.3 Patch available GHSA-wgxp-q8xq-wpp9
  • Magick.NET-Q16-HDRI-OpenMP-arm64 (NuGet) Vendor— Affected before 14.10.3 Fixed in 14.10.3 Patch available GHSA-wgxp-q8xq-wpp9
  • Magick.NET-Q16-HDRI-OpenMP-x64 (NuGet) Vendor— Affected before 14.10.3 Fixed in 14.10.3 Patch available GHSA-wgxp-q8xq-wpp9
  • Magick.NET-Q16-HDRI-arm64 (NuGet) Vendor— Affected before 14.10.3 Fixed in 14.10.3 Patch available GHSA-wgxp-q8xq-wpp9
  • Magick.NET-Q16-HDRI-x64 (NuGet) Vendor— Affected before 14.10.3 Fixed in 14.10.3 Patch available GHSA-wgxp-q8xq-wpp9
  • Magick.NET-Q16-HDRI-x86 (NuGet) Vendor— Affected before 14.10.3 Fixed in 14.10.3 Patch available GHSA-wgxp-q8xq-wpp9
  • Magick.NET-Q16-OpenMP-arm64 (NuGet) Vendor— Affected before 14.10.3 Fixed in 14.10.3 Patch available GHSA-wgxp-q8xq-wpp9
  • Magick.NET-Q16-OpenMP-x64 (NuGet) Vendor— Affected before 14.10.3 Fixed in 14.10.3 Patch available GHSA-wgxp-q8xq-wpp9
  • Magick.NET-Q16-OpenMP-x86 (NuGet) Vendor— Affected before 14.10.3 Fixed in 14.10.3 Patch available GHSA-wgxp-q8xq-wpp9
  • Magick.NET-Q16-arm64 (NuGet) Vendor— Affected before 14.10.3 Fixed in 14.10.3 Patch available GHSA-wgxp-q8xq-wpp9
  • Magick.NET-Q16-x64 (NuGet) Vendor— Affected before 14.10.3 Fixed in 14.10.3 Patch available GHSA-wgxp-q8xq-wpp9
  • Magick.NET-Q16-x86 (NuGet) Vendor— Affected before 14.10.3 Fixed in 14.10.3 Patch available GHSA-wgxp-q8xq-wpp9
  • Magick.NET-Q8-AnyCPU (NuGet) Vendor— Affected before 14.10.3 Fixed in 14.10.3 Patch available GHSA-wgxp-q8xq-wpp9
  • Magick.NET-Q8-OpenMP-arm64 (NuGet) Vendor— Affected before 14.10.3 Fixed in 14.10.3 Patch available GHSA-wgxp-q8xq-wpp9
  • Magick.NET-Q8-OpenMP-x64 (NuGet) Vendor— Affected before 14.10.3 Fixed in 14.10.3 Patch available GHSA-wgxp-q8xq-wpp9
  • Magick.NET-Q8-arm64 (NuGet) Vendor— Affected before 14.10.3 Fixed in 14.10.3 Patch available GHSA-wgxp-q8xq-wpp9
  • Magick.NET-Q8-x64 (NuGet) Vendor— Affected before 14.10.3 Fixed in 14.10.3 Patch available GHSA-wgxp-q8xq-wpp9
  • Magick.NET-Q8-x86 (NuGet) Vendor— Affected before 14.10.3 Fixed in 14.10.3 Patch available GHSA-wgxp-q8xq-wpp9

Remediation

  • Fix · GHSA-wgxp-q8xq-wpp9 Magick.NET-Q16-AnyCPU (NuGet) Fixed in 14.10.3 Advisory →
  • Fix · GHSA-wgxp-q8xq-wpp9 Magick.NET-Q16-HDRI-AnyCPU (NuGet) Fixed in 14.10.3 Advisory →
  • Fix · GHSA-wgxp-q8xq-wpp9 Magick.NET-Q16-HDRI-OpenMP-arm64 (NuGet) Fixed in 14.10.3 Advisory →
  • Fix · GHSA-wgxp-q8xq-wpp9 Magick.NET-Q16-HDRI-OpenMP-x64 (NuGet) Fixed in 14.10.3 Advisory →
  • Fix · GHSA-wgxp-q8xq-wpp9 Magick.NET-Q16-HDRI-arm64 (NuGet) Fixed in 14.10.3 Advisory →
  • Fix · GHSA-wgxp-q8xq-wpp9 Magick.NET-Q16-HDRI-x64 (NuGet) Fixed in 14.10.3 Advisory →
  • Fix · GHSA-wgxp-q8xq-wpp9 Magick.NET-Q16-HDRI-x86 (NuGet) Fixed in 14.10.3 Advisory →
  • Fix · GHSA-wgxp-q8xq-wpp9 Magick.NET-Q16-OpenMP-arm64 (NuGet) Fixed in 14.10.3 Advisory →
  • Fix · GHSA-wgxp-q8xq-wpp9 Magick.NET-Q16-OpenMP-x64 (NuGet) Fixed in 14.10.3 Advisory →
  • Fix · GHSA-wgxp-q8xq-wpp9 Magick.NET-Q16-OpenMP-x86 (NuGet) Fixed in 14.10.3 Advisory →
  • Fix · GHSA-wgxp-q8xq-wpp9 Magick.NET-Q16-arm64 (NuGet) Fixed in 14.10.3 Advisory →
  • Fix · GHSA-wgxp-q8xq-wpp9 Magick.NET-Q16-x64 (NuGet) Fixed in 14.10.3 Advisory →
  • Fix · GHSA-wgxp-q8xq-wpp9 Magick.NET-Q16-x86 (NuGet) Fixed in 14.10.3 Advisory →
  • Fix · GHSA-wgxp-q8xq-wpp9 Magick.NET-Q8-AnyCPU (NuGet) Fixed in 14.10.3 Advisory →
  • Fix · GHSA-wgxp-q8xq-wpp9 Magick.NET-Q8-OpenMP-arm64 (NuGet) Fixed in 14.10.3 Advisory →
  • Fix · GHSA-wgxp-q8xq-wpp9 Magick.NET-Q8-OpenMP-x64 (NuGet) Fixed in 14.10.3 Advisory →
  • Fix · GHSA-wgxp-q8xq-wpp9 Magick.NET-Q8-arm64 (NuGet) Fixed in 14.10.3 Advisory →
  • Fix · GHSA-wgxp-q8xq-wpp9 Magick.NET-Q8-x64 (NuGet) Fixed in 14.10.3 Advisory →
  • Fix · GHSA-wgxp-q8xq-wpp9 Magick.NET-Q8-x86 (NuGet) Fixed in 14.10.3 Advisory →

Timeline

  1. 2026-10-03 Threatist record created from GHSA-wgxp-q8xq-wpp9

References

Other 4

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences