CVE-2026-26284: ImageMagick: Heap overflow in pcd decoder leads to out of bounds read.

March 12, 2026

The pcd coder lacks proper boundary checking when processing Huffman-coded data. The decoder contains an function that has an incorrect initialization that could cause an out of bounds read.

==3900053==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x502000003c6c at pc 0x55601b9cc552 bp 0x7ffd904b1f70 sp 0x7ffd904b1f60
READ of size 1 at 0x502000003c6c thread T0

References

github.com/ImageMagick/ImageMagick
github.com/ImageMagick/ImageMagick/security/advisories/GHSA-wrhr-rf8j-r842
github.com/advisories/GHSA-wrhr-rf8j-r842
github.com/dlemstra/Magick.NET/releases/tag/14.10.3
nvd.nist.gov/vuln/detail/CVE-2026-26284

Code Behaviors & Features

Detect and mitigate CVE-2026-26284 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →