CVE-2026-26284: ImageMagick PCD Out of Bounds Read Fixed

CVE-2026-26284 is a medium severity (CVSS 6.5) out of bounds read in the PCD (Photo CD) decoder of ImageMagick. Versions before 7.1.2-15 and before 6.9.13-40 are affected. Update to 7.1.2-15 or 6.9.13-40, or restrict the PCD format if your service does not need to read it.

What's affected

The ImageMagick advisory (GHSA-wrhr-rf8j-r842) lists affected versions as anything before 7.1.2-15 in the 7.x line and anything before 6.9.13-40 in the 6.x line. The patched versions are 7.1.2-15 and 6.9.13-40.

The flaw is in the PCD coder, which handles Kodak Photo CD files. It lacks proper boundary checking when processing Huffman coded data. A function in the decoder has an incorrect initialization, and that can cause a read past the end of a buffer.

ImageMagick is embedded in many things: image upload services, thumbnail generators, document converters and language bindings. You may have it without having installed it on purpose.

How to check if you're exposed

Check the version on each host and in each container image:

magick -version
# on older 6.x installs the command may be:
convert -version

Compare the output with 7.1.2-15 and 6.9.13-40. Linux distributions often backport fixes without changing the upstream version number, so a version that looks old may still be patched. Check your distribution's security notice for this CVE before you decide.

For containers, run the same command inside the image, or use a scanner that reads the package list of the image.

Then check whether the PCD format is enabled and reachable:

magick -list format | grep -i pcd

Finally, ask where ImageMagick is called with files that come from users. A service that converts uploads is the exposed case.

What to do now

1. Update ImageMagick to 7.1.2-15 or later on the 7.x line, or to 6.9.13-40 or later on the 6.x line. Rebuild container images that bundle it.
2. If you use a distribution package, apply the distribution's update for this CVE and confirm the package changelog mentions it.
3. If you cannot update at once and your service never needs PCD files, disable the coder in the ImageMagick policy.xml. This is general ImageMagick hardening and not a step from the advisory, so test it first.
4. Limit what file types your upload services accept. Allow the formats you need, not every format ImageMagick can read.
5. Run image processing in a separate low privilege process or container with memory and time limits.

Why it matters

The record lists three weakness classes: CWE-122 heap based buffer overflow, CWE-125 out of bounds read and CWE-787 out of bounds write. The advisory text describes an out of bounds read, and its title says the heap overflow in the PCD decoder leads to one. The sample output in the advisory comes from AddressSanitizer, a memory error detector, and reports a one byte heap read.

The CVSS vector, CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L, scores low impact on confidentiality and availability and none on integrity. That is why this is 6.5 and not critical. A bad read can leak a little memory or crash the process that handles the image.

None of that makes it ignorable. A crash in an image conversion service is a denial of service, and image libraries are a steady source of parser bugs. The record is not on the CISA Known Exploited Vulnerabilities list.

The habit worth building is knowing where image libraries live in your stack. A dependency scan of your images and repositories shows which ones carry ImageMagick and at what version.

Try it yourself

Click through it at your own pace, or open it full screen.

Quick check

Sources

• ImageMagick security advisory GHSA-wrhr-rf8j-r842
• NVD record for CVE-2026-26284

Last reviewed: 19 October 2026.