CVE-2026-24485: ImageMagick: Infinite loop vulnerability when parsing a PCD file
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, when a PCD file does not contain a valid Sync marker, the DecodeImage() function becomes trapped in an infinite loop while searching for the Sync marker, causing the program to become unresponsive and continuously consume CPU resources, ultimately leading to system resource exhaustion and denial of service. Versions 7.1.2-15 and 6.9.13-40 contain a patch.
Other sources
When a PCD file does not contain a valid marker, the DecodeImage() function becomes trapped in an infinite loop while searching for the marker, causing the program to become unresponsive and continuously consume CPU resources, ultimately leading to system resource exhaustion and denial of service.
— GitHub
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2026-24485?
CVE-2026-24485 is classified as a high severity vulnerability due to the potential for denial of service via an infinite loop when parsing certain PCD files.
How do I fix CVE-2026-24485?
To fix CVE-2026-24485, upgrade ImageMagick to version 7.1.2-15 or 6.9.13-40 or later.
What affected versions are associated with CVE-2026-24485?
CVE-2026-24485 affects ImageMagick versions prior to 7.1.2-15 and 6.9.13-40.
Which software should I upgrade to remediate CVE-2026-24485?
You should upgrade to any version of ImageMagick that is 7.1.2-15 or 6.9.13-40 and later to remediate CVE-2026-24485.
What happens if I do not address CVE-2026-24485?
If CVE-2026-24485 is not addressed, an attacker could exploit the vulnerability to cause the application to enter an infinite loop, potentially leading to service downtime.