CVE-2026-26284
Published: 24 February 2026
Summary
CVE-2026-26284 is a medium-severity Heap-based Buffer Overflow (CWE-122) vulnerability in Imagemagick Imagemagick. Its CVSS base score is 6.5 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 6.6th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
Threat & Defense at a Glance
Threat & Defense Details
Likely Mitigating ControlsAI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Out-of-bounds writes that corrupt control flow or inject shellcode are rendered non-executable by the same memory protections.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The vulnerability allows remote unauthenticated attackers to supply a crafted PCD file to ImageMagick instances (e.g., in web apps or processing pipelines), directly enabling exploitation of public-facing applications for limited info disclosure or DoS.
NVD Description
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, ImageMagick lacks proper boundary checking when processing Huffman-coded data from PCD (Photo CD) files. The decoder contains an function that has…
more
an incorrect initialization that could cause an out of bounds read. Versions 7.1.2-15 and 6.9.13-40 contain a patch.
Deeper analysisAI
CVE-2026-26284 is a vulnerability in ImageMagick, a free and open-source software suite for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, the software lacks proper boundary checking when processing Huffman-coded data in PCD (Photo CD) files. Specifically, a decoder function suffers from incorrect initialization, which can lead to an out-of-bounds read. This issue is classified under CWE-122 (Heap-based Buffer Over-read), CWE-787 (Out-of-bounds Write), and CWE-125 (Out-of-bounds Read), with a CVSS v3.1 base score of 6.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L).
The vulnerability can be exploited remotely by unauthenticated attackers with network access, requiring low complexity and no user interaction. By supplying a specially crafted PCD file to an ImageMagick instance, such as in a web application or image processing pipeline, an attacker can trigger the out-of-bounds read. This may result in limited disclosure of sensitive information from memory or a denial of service via application crash, though integrity is unaffected.
The official GitHub security advisory (GHSA-wrhr-rf8j-r842) confirms that ImageMagick versions 7.1.2-15 and 6.9.13-40 address the issue with a patch fixing the decoder's initialization and boundary checks. Security practitioners should upgrade to these versions or later and consider disabling PCD file processing if not required, via ImageMagick's policy configuration.
Details
- CWE(s)