Patchwire CVEs, their patch status, and feeds to follow them

CVE-2026-56378

Fixed in a distro release EPSS <1%CVSS 3.7

ImageMagick before 7.1.2-15 (and 6.x before 6.9.13-40) contains a heap out-of-bounds read in the PCD coder's DecodeImage loop. A crafted PCD file can trigger a one-byte heap out-of-bounds read during image decoding, resulting in denial of service and potential disclosure of an adjacent heap byte.

Published 2026-06-21 · CVE record · OSV

Products: imagemagick

Fixed upstream

EcosystemPackageFixed in
NuGetMagick.NET-Q16-AnyCPU14.10.3
NuGetMagick.NET-Q16-HDRI-AnyCPU14.10.3
NuGetMagick.NET-Q16-HDRI-OpenMP-arm6414.10.3
NuGetMagick.NET-Q16-HDRI-OpenMP-x6414.10.3
NuGetMagick.NET-Q16-HDRI-arm6414.10.3
NuGetMagick.NET-Q16-HDRI-x6414.10.3
NuGetMagick.NET-Q16-HDRI-x8614.10.3
NuGetMagick.NET-Q16-OpenMP-arm6414.10.3
NuGetMagick.NET-Q16-OpenMP-x6414.10.3
NuGetMagick.NET-Q16-OpenMP-x8614.10.3
NuGetMagick.NET-Q16-arm6414.10.3
NuGetMagick.NET-Q16-x6414.10.3
NuGetMagick.NET-Q16-x8614.10.3
NuGetMagick.NET-Q8-AnyCPU14.10.3
NuGetMagick.NET-Q8-OpenMP-arm6414.10.3
NuGetMagick.NET-Q8-OpenMP-x6414.10.3
NuGetMagick.NET-Q8-arm6414.10.3
NuGetMagick.NET-Q8-x6414.10.3
NuGetMagick.NET-Q8-x8614.10.3

Distro releases

ReleasePackageFixed in
Debian 12imagemagick8:6.9.11.60+dfsg-1.6+deb12u12
Debian 13imagemagick8:7.1.1.43+dfsg1-1+deb13u11
Debian 14imagemagick8:7.1.2.15+dfsg1-1
Ubuntu 25.10imagemagickno fix
Ubuntu Pro 14.04 LTSimagemagick8:6.7.7.10-6ubuntu3.13+esm25
Ubuntu Pro 16.04 LTSimagemagick8:6.8.9.9-7ubuntu5.16+esm24
Ubuntu Pro 18.04 LTSimagemagick8:6.9.7.4+dfsg-16ubuntu6.15+esm16
Ubuntu Pro 20.04 LTSimagemagick8:6.9.10.23+dfsg-2.1ubuntu11.11+esm14
Ubuntu Pro 22.04 LTSimagemagick8:6.9.11.60+dfsg-1.3ubuntu0.22.04.5+esm14
Ubuntu Pro 24.04 LTSimagemagick8:6.9.12.98+dfsg1-5.2ubuntu0.1~esm13
Ubuntu Pro 26.04 LTSimagemagick8:7.1.2.18+dfsg1-1ubuntu0.1~esm2