ImageMagick: Integer Overflow in PSB (PSD v2) RLE decoding path causes heap Out of Bounds reads for 32-bit builds
An integer overflow in the PSB (PSD v2) RLE decoding path causes a heap out-of-bounds read on 32-bit builds. This can lead to information disclosure or a crash when processing crafted PSB files. ``` ================================================================= ==3298==ERROR: AddressSanitizer: heap-buffer-overflow on address 0xf512eb00 at pc 0xf76760b5 bp 0xffc1dfb8 sp 0xffc1dfa8 READ of size 8 at 0xf512eb00 thread T0 #0 0xf76760b4 in ReadPSDChannelRLE coders/psd.c:1141 ```
describes (2)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2026-56367US | critical9.1 | — | ||
ImageMagick before 7.1.2-15 and 6.9.x before 6.9.13-40 contains an integer overflow in the PSB (PSD v2) RLE decoding path (ReadPSDChannelRLE in coders/psd.c) that causes a heap out… | ||||
| CVE-2026-25984US | — | — | ||
Rejected reason: This CVE was assigned in error. | ||||
references
External citations — patches, advisories, analysis.
- https://github.com/ImageMagick/ImageMagickPACKAGE
- https://github.com/ImageMagick/ImageMagick/commit/5b91ab69af614024255fd93dcc9a62b41fbc435cWEB
- https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-273h-m46v-96q4WEB
- https://github.com/dlemstra/Magick.NET/releases/tag/14.10.3WEB
- https://nvd.nist.gov/vuln/detail/CVE-2026-25984ADVISORY
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan