ImageMagick: Integer Overflow in PSB (PSD v2) RLE decoding path causes heap Out of Bounds reads for 32-bit builds
An integer overflow in the PSB (PSD v2) RLE decoding path causes a heap out-of-bounds read on 32-bit builds. This can lead to information disclosure or a crash when processing crafted PSB files.
=================================================================
==3298==ERROR: AddressSanitizer: heap-buffer-overflow on address 0xf512eb00 at pc 0xf76760b5 bp 0xffc1dfb8 sp 0xffc1dfa8
READ of size 8 at 0xf512eb00 thread T0
#0 0xf76760b4 in ReadPSDChannelRLE coders/psd.c:1141Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| .NET (NuGet) | Magick.NET-Q16-AnyCPU | < 14.10.3 | 14.10.3 |
| .NET (NuGet) | Magick.NET-Q16-arm64 | < 14.10.3 | 14.10.3 |
| .NET (NuGet) | Magick.NET-Q16-HDRI-AnyCPU | < 14.10.3 | 14.10.3 |
| .NET (NuGet) | Magick.NET-Q16-HDRI-arm64 | < 14.10.3 | 14.10.3 |
| .NET (NuGet) | Magick.NET-Q16-HDRI-OpenMP-arm64 | < 14.10.3 | 14.10.3 |
| .NET (NuGet) | Magick.NET-Q16-HDRI-OpenMP-x64 | < 14.10.3 | 14.10.3 |
| .NET (NuGet) | Magick.NET-Q16-HDRI-x64 | < 14.10.3 | 14.10.3 |
| .NET (NuGet) | Magick.NET-Q16-HDRI-x86 | < 14.10.3 | 14.10.3 |
| .NET (NuGet) | Magick.NET-Q16-OpenMP-arm64 | < 14.10.3 | 14.10.3 |
| .NET (NuGet) | Magick.NET-Q16-OpenMP-x64 | < 14.10.3 | 14.10.3 |
| .NET (NuGet) | Magick.NET-Q16-OpenMP-x86 | < 14.10.3 | 14.10.3 |
| .NET (NuGet) | Magick.NET-Q16-x64 | < 14.10.3 | 14.10.3 |
| .NET (NuGet) | Magick.NET-Q16-x86 | < 14.10.3 | 14.10.3 |
| .NET (NuGet) | Magick.NET-Q8-AnyCPU | < 14.10.3 | 14.10.3 |
| .NET (NuGet) | Magick.NET-Q8-arm64 | < 14.10.3 | 14.10.3 |
| .NET (NuGet) | Magick.NET-Q8-OpenMP-arm64 | < 14.10.3 | 14.10.3 |
| .NET (NuGet) | Magick.NET-Q8-OpenMP-x64 | < 14.10.3 | 14.10.3 |
| .NET (NuGet) | Magick.NET-Q8-x64 | < 14.10.3 | 14.10.3 |
| .NET (NuGet) | Magick.NET-Q8-x86 | < 14.10.3 | 14.10.3 |
References
- https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-273h-m46v-96q4
- https://nvd.nist.gov/vuln/detail/CVE-2026-25984
- https://github.com/ImageMagick/ImageMagick/commit/5b91ab69af614024255fd93dcc9a62b41fbc435c
- https://github.com/ImageMagick/ImageMagick
- https://github.com/dlemstra/Magick.NET/releases/tag/14.10.3
- CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N- Weakness (CWE)
CWE-125, CWE-190- Platform
- .NET (NuGet)
- Package
Magick.NET-Q16-AnyCPU, Magick.NET-Q16-arm64, Magick.NET-Q16-HDRI-AnyCPU- Disclosed
- 25.02.2026
- Updated
- 11.10.2026 11:23
Sources and licenses
OSV / GitHub Advisory Database - GHSA-273h-m46v-96q4 - CC BY 4.0
Vulnerability history: Magick.NET-Q16-HDRI-OpenMP-arm64
All published vulnerabilities of this package (.NET (NuGet)), newest first. Shows whether this is a one-off slip or a package that needs watching.
- Total entries
- 160
- First → latest
- 07.2025 09.2026
- Without a fix
- 1
- Exploited in attacks
- 0
Severity breakdown
- High 24
- Medium 96
- Low 40
Disclosures per year
- 2025: 14
- 2026: 146
-
ImageMagick: Integer Overflow in PSB (PSD v2) RLE decoding path causes heap Out of Bounds reads for 32-bit builds this entry
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.