← Back

CVE-2026-24485

nvd nist
Published: Feb 24, 2026Modified: Feb 27, 2026

JSON object

Loading...
7.5
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Exploitability: 3.9 / Impact: 3.6
Source: security-advisories@github.com (Secondary)

Description

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, when a PCD file does not contain a valid Sync marker, the DecodeImage() function becomes trapped in an infinite loop while searching for the Sync marker, causing the program to become unresponsive and continuously consume CPU resources, ultimately leading to system resource exhaustion and denial of service. Versions 7.1.2-15 and 6.9.13-40 contain a patch.

Affected (3)

Imagemagick
1 product
Imagemagick
Dlemstra
1 product
Magick.net
Configuration A
2 vulnerable
Vulnerable SoftwareAffected Versions
Imagemagick
Imagemagick
Before 6.9.13-40
Imagemagick
From 7.0.0-0 to 7.1.2-15
Configuration B
1 vulnerable
Vulnerable SoftwareAffected Versions
Magick.net
Before 14.10.3

Related CWEs

CWE-400
Uncontrolled Resource Consumption
The product does not properly control the allocation and maintenance of a limited resource, thereby enabling an actor to influence the amount of resources consumed, eventually leading to the exhaustion of available resources.

References (3)

Source: security-advisories@github.com
Patch
Source: security-advisories@github.com
Vendor Advisory
Source: security-advisories@github.com
ProductRelease Notes

Timeline

No history available yet.