ImageMagick has Possible Heap Information Disclosure in PSD ZIP Decompression
Summary
ImageMagick has Possible Heap Information Disclosure in PSD ZIP Decompression
Original description
The description as published by the source.
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, a heap information disclosure vulnerability exists in ImageMagick's PSD (Adobe Photoshop) format handler. When processing a maliciously crafted PSD file containing ZIP-compressed layer data that decompresses to less than the expected size, uninitialized heap memory is leaked into the output image. Versions 7.1.2-15 and 6.9.13-40 contain a patch.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Fix status by distribution
Fixed packages published by each distribution for this CVE
- Debian DEBIAN-CVE-2026-24481 imagemagick Fixed in: 8:6.9.11.60+dfsg-1.3+deb11u10
- Ubuntu UBUNTU-CVE-2026-24481 imagemagick
References
- advisory github.com
- advisory github.com
- advisory nvd.nist.gov