Vulnerability · Published Feb 24, 2026 · Assigned by GitHub_M
CVE-2026-24485ImageMagick: Infinite loop vulnerability when parsing a PCD file
High 7.5
In plain English
A high-severity uncontrolled resource consumption in ImageMagick from ImageMagick. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 43% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, when a PCD file does not contain a valid Sync marker, the DecodeImage() function becomes trapped in an infinite loop while searching for the Sync marker, causing the program to become unresponsive and continuously consume CPU resources, ultimately leading to system resource exhaustion and denial of service. Versions 7.1.2-15 and 6.9.13-40 contain a patch.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine:v3.22 | imagemagick | 7.1.2.15-r0 | ALPINE-CVE-2026-24485 |
| Alpine:v3.23 | imagemagick | 7.1.2.15-r0 | ALPINE-CVE-2026-24485 |
| Alpine:v3.24 | imagemagick | 7.1.2.15-r0 | ALPINE-CVE-2026-24485 |
| Debian:12 | imagemagick | 8:6.9.11.60+dfsg-1.6+deb12u7 | DEBIAN-CVE-2026-24485 |
| Debian:12 | imagemagick | 8:6.9.11.60+dfsg-1.6+deb12u7 | DSA-6159-1 |
| Debian:13 | imagemagick | 8:7.1.1.43+dfsg1-1+deb13u6 | DSA-6158-1 |
| Debian:13 | imagemagick | 8:7.1.1.43+dfsg1-1+deb13u6 | DEBIAN-CVE-2026-24485 |
| Debian:14 | imagemagick | 8:7.1.2.15+dfsg1-1 | DEBIAN-CVE-2026-24485 |
| NuGet | magick.net-q16-anycpu | 14.10.3 | GHSA-pqgj-2p96-rx85 |
| NuGet | magick.net-q16-arm64 | 14.10.3 | GHSA-pqgj-2p96-rx85 |
| NuGet | magick.net-q16-hdri-anycpu | 14.10.3 | GHSA-pqgj-2p96-rx85 |
| NuGet | magick.net-q16-hdri-arm64 | 14.10.3 | GHSA-pqgj-2p96-rx85 |
| NuGet | magick.net-q16-hdri-openmp-arm64 | 14.10.3 | GHSA-pqgj-2p96-rx85 |
| NuGet | magick.net-q16-hdri-openmp-x64 | 14.10.3 | GHSA-pqgj-2p96-rx85 |
| NuGet | magick.net-q16-hdri-x64 | 14.10.3 | GHSA-pqgj-2p96-rx85 |
| NuGet | magick.net-q16-hdri-x86 | 14.10.3 | GHSA-pqgj-2p96-rx85 |
| NuGet | magick.net-q16-openmp-arm64 | 14.10.3 | GHSA-pqgj-2p96-rx85 |
| NuGet | magick.net-q16-openmp-x64 | 14.10.3 | GHSA-pqgj-2p96-rx85 |
| NuGet | magick.net-q16-openmp-x86 | 14.10.3 | GHSA-pqgj-2p96-rx85 |
| NuGet | magick.net-q16-x64 | 14.10.3 | GHSA-pqgj-2p96-rx85 |
| NuGet | magick.net-q16-x86 | 14.10.3 | GHSA-pqgj-2p96-rx85 |
| NuGet | magick.net-q8-anycpu | 14.10.3 | GHSA-pqgj-2p96-rx85 |
| NuGet | magick.net-q8-arm64 | 14.10.3 | GHSA-pqgj-2p96-rx85 |
| NuGet | magick.net-q8-openmp-arm64 | 14.10.3 | GHSA-pqgj-2p96-rx85 |
| NuGet | magick.net-q8-openmp-x64 | 14.10.3 | GHSA-pqgj-2p96-rx85 |
| NuGet | magick.net-q8-x64 | 14.10.3 | GHSA-pqgj-2p96-rx85 |
| NuGet | magick.net-q8-x86 | 14.10.3 | GHSA-pqgj-2p96-rx85 |
| Ubuntu:25.10 | imagemagick | 8:7.1.2.3+dfsg1-1ubuntu0.1 | UBUNTU-CVE-2026-24485 |
| Ubuntu:25.10 | imagemagick | 8:7.1.2.3+dfsg1-1ubuntu0.1 | USN-8263-1 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| ImageMagick | ImageMagick | >= 7.0.0, < 7.1.2-15< 6.9.13-40 |
Weakness: CWE-400 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H