PT-2026-21587 · Unknown+3 · Imagemagick+3

Ylwango613 · CVE-2026-24485 · Published 2026-02-23 · Updated 2026-06-16

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions ImageMagick versions prior to 7.1.2-15 ImageMagick versions prior to 6.9.13-40

Description ImageMagick is software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, a crafted PCD file lacking a valid Sync marker causes the DecodeImage() function to enter an infinite loop while searching for the marker. This results in the program becoming unresponsive and consuming CPU resources, potentially leading to system resource exhaustion and a denial of service.

Recommendations Update to ImageMagick version 7.1.2-15 or later. Update to ImageMagick version 6.9.13-40 or later.

Exploit

Fix

DoS

Out of bounds Read

Resource Exhaustion

Weakness Enumeration

CWE-125

CWE-400

Related Identifiers

BDU:2026-09362

CVE-2026-24485

ECHO-8502-3F7F-E2B6

GHSA-PQGJ-2P96-RX85

OESA-2026-1452

OESA-2026-1453

OESA-2026-1454

OESA-2026-1455

OESA-2026-1456

OESA-2026-1457

OPENSUSE-SU-2026:10267-1

OPENSUSE-SU-2026:20337-1

SUSE-SU-2026:0851-1

SUSE-SU-2026:0852-1

SUSE-SU-2026:0853-1

SUSE-SU-2026:0854-1

USN-8263-1

Affected Products

Imagemagick

Linuxmint

Red Os

Ubuntu

References · 171

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/24xxx/CVE-2026-24485.json · Exploit
• https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-pqgj-2p96-rx85 · Vendor Advisory
• https://github.com/ImageMagick/ImageMagick/commit/332c1566acc2de77857032d3c2504ead6210ff50 · Patch
• https://osv.dev/vulnerability/CVE-2026-24485 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-26283 · Security Note
• https://cve.org/CVERecord?id=CVE-2026-24485 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-25986 · Security Note
• https://osv.dev/vulnerability/OESA-2026-1455 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2026-1453 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-25968 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-25799 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2026-24485 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2026:20337-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-25638 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-24481 · Vendor Advisory