CVE-2026-56367: ImageMagick PSB RLE Decoding Out-of-Bounds Read
CVE-2026-56367 is an integer overflow in the PSB (PSD v2) RLE decoding path of ImageMagick, in ReadPSDChannelRLE in coders/psd.c, which leads to a heap out-of-bounds read on 32-bit builds. According to the record, processing a crafted PSB file can cause information disclosure or a crash. The record lists a NVD CVSS 3.1 base score of 9.1, but no KEV listing and no confirmed exploitation appear in the sources consulted.
Overview
CVE-2026-56367 affects the PSB (PSD v2) RLE decoding path in ImageMagick. The weakness is an integer overflow in ReadPSDChannelRLE, located in coders/psd.c, that leads to an out-of-bounds read on the heap. The record classifies the weakness as CWE-125 (Out-of-bounds Read). The vulnerability is described as affecting 32-bit builds.
Impact
- The record states that processing a crafted PSB file can lead to information disclosure or a crash.
- The NVD base score is 9.1 under CVSS 3.1 with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H, which indicates high confidentiality and availability impact over a network with no required privileges or user interaction.
- The VulnCheck CNA lists a CVSS 4.0 score of 6.3 and a CVSS 3.1 score of 3.7. These differing scores reflect different assessments and should be read with their respective vectors and providers.
Affected products and versions
- The record lists the product as ImageMagick, with the range from 6.9.0 up to but not including 6.9.13-40 and the range from 7.1.2 up to but not including 7.1.2-15.
- The description states the affected branches as 6.9.x before 6.9.13-40 and versions before 7.1.2-15.
- The record contains no explicit fixed-version list. The upper bounds of the stated ranges suggest that 6.9.13-40 and 7.1.2-15 are the first versions outside the described range, which is an inference to be confirmed against the vendor advisory.
Exploitation status
The CISA KEV catalog does not list this CVE in the record, and the record contains no KEV date, due date or required action. No confirmed exploitation in the wild appears in the sources consulted. EPSS data is absent from the record.
Remediation and mitigation
- Upgrade ImageMagick deployments to versions outside the affected ranges, following the vendor advisory linked below.
- Where immediate upgrade is not possible, limit processing of PSB and PSD files from untrusted sources, and isolate image conversion workloads in restricted environments.
- Prioritize 32-bit builds and any service that processes user-supplied images automatically, such as thumbnail generators and upload pipelines.
- Review the vendor advisory for the official remediation guidance and any workarounds.
Detection guidance
- Maintain an inventory of ImageMagick binaries and libraries, including bundled copies in third-party software, and record their versions and architectures.
- Monitor logs of image-processing services for crashes, segmentation faults or abnormal termination when handling PSB files.
- Flag incoming PSB uploads for review in workflows that do not normally accept them.
Limitations of the available information
- The record gives no proof-of-concept details, no exploit prerequisites beyond the description, and no fixed-version list in the fixes field.
- No KEV, EPSS or SSVC data is present for this CVE.
- The exact affected 32-bit configurations are not enumerated in the record.
Frequently asked questions
What is CVE-2026-56367?
It is an integer overflow in the PSB (PSD v2) RLE decoding path of ImageMagick, in ReadPSDChannelRLE in coders/psd.c, that leads to a heap out-of-bounds read on 32-bit builds.
What can an attacker achieve according to the record?
The record states that processing a crafted PSB file can lead to information disclosure or a crash.
Is this CVE known to be actively exploited?
The CVE is not listed in the CISA KEV catalog in the record, and no confirmed exploitation in the wild appears in the sources consulted.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.