PT-2026-21587 · Unknown · Imagemagick

Ylwango613 · Published 2026-02-24 · Updated 2026-05-11 · CVE-2026-24485

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions ImageMagick versions prior to 7.1.2-15 ImageMagick versions prior to 6.9.13-40

Description ImageMagick is software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, a crafted PCD file lacking a valid Sync marker causes the DecodeImage() function to enter an infinite loop while searching for the marker. This results in the program becoming unresponsive and consuming CPU resources, potentially leading to system resource exhaustion and a denial of service.

Recommendations Update to ImageMagick version 7.1.2-15 or later. Update to ImageMagick version 6.9.13-40 or later.

Exploit

Fix

DoS

Resource Exhaustion

Weakness Enumeration

CWE-400

Related Identifiers

CVE-2026-24485

ECHO-8502-3F7F-E2B6

GHSA-PQGJ-2P96-RX85

OESA-2026-1452

OESA-2026-1453

OESA-2026-1454

OESA-2026-1455

OESA-2026-1456

OESA-2026-1457

OPENSUSE-SU-2026:10267-1

OPENSUSE-SU-2026:20337-1

SUSE-SU-2026:0851-1

SUSE-SU-2026:0852-1

SUSE-SU-2026:0853-1

SUSE-SU-2026:0854-1

USN-8263-1

Affected Products

Imagemagick

References · 165

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/24xxx/CVE-2026-24485.json · Exploit
• https://github.com/ImageMagick/ImageMagick/commit/332c1566acc2de77857032d3c2504ead6210ff50 · Patch
• https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-pqgj-2p96-rx85 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-pqgj-2p96-rx85 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-24485 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-25988 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-25798 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-25796 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-25637 · Security Note
• https://osv.dev/vulnerability/OESA-2026-1453 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-25795 · Security Note
• https://osv.dev/vulnerability/USN-8263-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-25794 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-24485 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-25799 · Security Note