CVE-2026-56367 is a low severity (CVSS 3.7) out-of-bounds read in ImageMagick's PSB image decoder, and it affects 32-bit builds only. Fixed versions are 7.1.2-15 and 6.9.13-40. Upgrade, and check whether any of your image services run a 32-bit ImageMagick.
What's affected
The ImageMagick advisory (GHSA-273h-m46v-96q4) says affected versions are before 7.1.2-15 and before 6.9.13-40, and that the patched versions are 7.1.2-15 and 6.9.13-40. It marks the package as 32-bit builds only.
The cause is an integer overflow in the RLE decoding of PSB files, the large document variant of Photoshop's format. The function named is ReadPSDChannelRLE in coders/psd.c. A crafted file can lead to a heap out-of-bounds read, which can expose memory contents or crash the process.
The score is low because the vector has high attack complexity and limited confidentiality impact.
How to check if you're exposed
Two questions decide your exposure: which version, and which architecture.
magick -version
convert -version
- The output shows the version and, in the feature list, the build details. A 64-bit build is not covered by this advisory.
- Check container images and server packages too. Image processing libraries often arrive as a dependency of a web framework, a document converter or a thumbnail service.
- If you cannot restrict input, check your ImageMagick policy file and consider disabling the PSD and PSB formats if you do not need them.
Run the free in-browser dependency scan at https://gold.safeguard.sh/scan against your manifest or lockfile. It lists vulnerable packages without installing anything.
What to do now
- Upgrade ImageMagick to 7.1.2-15 or later, or to 6.9.13-40 or later on the 6.x branch.
- Find 32-bit builds in your estate first, since they are the only ones affected.
- Rebuild container images that bundle ImageMagick, and redeploy.
- If you accept uploads, disable formats you do not need in the ImageMagick policy file.
- Process untrusted images in a sandboxed worker with a time and memory limit.
Why it matters
The weakness is CWE-125, out-of-bounds read. Here an integer overflow makes the decoder miscalculate a size on 32-bit builds, so it reads past the end of a heap buffer. Reading memory that does not belong to the image can leak data from the process or crash it.
The practical lesson is about reachability. A flaw that affects only one image format on one architecture is irrelevant to many systems and important to a few. Knowing which of your services actually run the vulnerable code path lets you spend effort where it counts. The record is not in CISA's Known Exploited Vulnerabilities catalog.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Why is the severity so low?
The vector needs a crafted file, has high attack complexity and only low confidentiality impact. It also applies to 32-bit builds only.
Sources
Last reviewed: 19 October 2026.
