ImageMagick has heap overflow in pcd decoder that leads to out of bounds read.

CVE-2026-26284 is a vulnerability in ImageMagick's PCD (Photo CD) image decoder [1]. The software fails to properly validate boundary conditions when processing Huffman-coded data from PCD files. The decoder function contains an incorrect initialization that can lead to an out-of-bounds read [2][4].

An attacker can exploit this issue by crafting a malicious PCD file and delivering it to an application that uses ImageMagick for image processing. The vulnerability does not require authentication or user interaction beyond opening the file, and it can be triggered remotely if the application processes user-supplied images [4].

Successful exploitation could allow the attacker to read memory beyond the intended buffer boundaries, potentially leaking sensitive information or causing a denial of service via a crash. The CVSS vector (not fully assessed by NVD at publication) suggests the impact on confidentiality, integrity, and availability could vary [2][4].

The issue is resolved in ImageMagick versions 7.1.2-15 and 6.9.13-40. Users are advised to update to these or later versions. No workaround is documented, but applying a security policy to restrict processing of PCD files may reduce risk [2][4].