ImageMagick: Infinite loop vulnerability when parsing a PCD file

Vulnerability

Details CVE-2026-24485 describes an infinite loop vulnerability in ImageMagick's handling of Photo CD (PCD) files. The flaw exists in the DecodeImage() function, which enters an unbounded search for a Sync marker when the PCD file does not contain a valid one. This causes the program to become unresponsive and continuously consume CPU resources, leading to system resource exhaustion.[1]

Exploitation

An attacker can exploit this vulnerability by crafting a specially malformed PCD file that omits the required Sync marker. No authentication or special privileges are required; processing the file via any ImageMagick utility or integration (e.g., a web application that accepts image uploads) is sufficient to trigger the infinite loop. The PCDGetBits() macro, which reads chunks of data from the blob, lacked proper validation of the return value from ReadBlob(), causing it to spin indefinitely when fewer bytes than expected were read.[4]

Impact

Successful exploitation results in a denial of service (DoS), making the affected system unresponsive and exhausting CPU resources. This can impact server availability in environments where ImageMagick processes untrusted image files, such as image hosting services or content management systems.[1][2]

Mitigation

The vulnerability is patched in ImageMagick versions 7.1.2-15 and 6.9.13-40. The fix, committed in commit 332c1566acc2de77857032d3c2504ead6210ff50, adds a check that breaks out of the read loop when ReadBlob() returns fewer bytes than requested.[4] Users should update to the patched versions and ensure that untrusted image files are processed under a restrictive security policy.[2]