HIGH 7.5
GHSA-pqgj-2p96-rx85
ImageMagick: Infinite loop vulnerability when parsing a PCD file
Details
When a PCD file does not contain a valid marker, the DecodeImage() function becomes trapped in an infinite loop while searching for the marker, causing the program to become unresponsive and continuously consume CPU resources, ultimately leading to system resource exhaustion and denial of service.
Are you affected?
Enter the version of the package you're using.
Affected packages
NuGet / Magick.NET-Q16-AnyCPU
Introduced in:
0 Fixed in: 14.10.3 Fix
dotnet add package Magick.NET-Q16-AnyCPU --version 14.10.3 NuGet / Magick.NET-Q16-HDRI-AnyCPU
Introduced in:
0 Fixed in: 14.10.3 Fix
dotnet add package Magick.NET-Q16-HDRI-AnyCPU --version 14.10.3 NuGet / Magick.NET-Q16-HDRI-OpenMP-arm64
Introduced in:
0 Fixed in: 14.10.3 Fix
dotnet add package Magick.NET-Q16-HDRI-OpenMP-arm64 --version 14.10.3 NuGet / Magick.NET-Q16-HDRI-OpenMP-x64
Introduced in:
0 Fixed in: 14.10.3 Fix
dotnet add package Magick.NET-Q16-HDRI-OpenMP-x64 --version 14.10.3 NuGet / Magick.NET-Q16-HDRI-arm64
Introduced in:
0 Fixed in: 14.10.3 Fix
dotnet add package Magick.NET-Q16-HDRI-arm64 --version 14.10.3 NuGet / Magick.NET-Q16-HDRI-x64
Introduced in:
0 Fixed in: 14.10.3 Fix
dotnet add package Magick.NET-Q16-HDRI-x64 --version 14.10.3 NuGet / Magick.NET-Q16-HDRI-x86
Introduced in:
0 Fixed in: 14.10.3 Fix
dotnet add package Magick.NET-Q16-HDRI-x86 --version 14.10.3 NuGet / Magick.NET-Q16-OpenMP-arm64
Introduced in:
0 Fixed in: 14.10.3 Fix
dotnet add package Magick.NET-Q16-OpenMP-arm64 --version 14.10.3 NuGet / Magick.NET-Q16-OpenMP-x64
Introduced in:
0 Fixed in: 14.10.3 Fix
dotnet add package Magick.NET-Q16-OpenMP-x64 --version 14.10.3 NuGet / Magick.NET-Q16-OpenMP-x86
Introduced in:
0 Fixed in: 14.10.3 Fix
dotnet add package Magick.NET-Q16-OpenMP-x86 --version 14.10.3 NuGet / Magick.NET-Q16-arm64
Introduced in:
0 Fixed in: 14.10.3 Fix
dotnet add package Magick.NET-Q16-arm64 --version 14.10.3 NuGet / Magick.NET-Q16-x64
Introduced in:
0 Fixed in: 14.10.3 Fix
dotnet add package Magick.NET-Q16-x64 --version 14.10.3 NuGet / Magick.NET-Q16-x86
Introduced in:
0 Fixed in: 14.10.3 Fix
dotnet add package Magick.NET-Q16-x86 --version 14.10.3 NuGet / Magick.NET-Q8-AnyCPU
Introduced in:
0 Fixed in: 14.10.3 Fix
dotnet add package Magick.NET-Q8-AnyCPU --version 14.10.3 NuGet / Magick.NET-Q8-OpenMP-arm64
Introduced in:
0 Fixed in: 14.10.3 Fix
dotnet add package Magick.NET-Q8-OpenMP-arm64 --version 14.10.3 NuGet / Magick.NET-Q8-OpenMP-x64
Introduced in:
0 Fixed in: 14.10.3 Fix
dotnet add package Magick.NET-Q8-OpenMP-x64 --version 14.10.3 NuGet / Magick.NET-Q8-arm64
Introduced in:
0 Fixed in: 14.10.3 Fix
dotnet add package Magick.NET-Q8-arm64 --version 14.10.3 NuGet / Magick.NET-Q8-x64
Introduced in:
0 Fixed in: 14.10.3 Fix
dotnet add package Magick.NET-Q8-x64 --version 14.10.3 NuGet / Magick.NET-Q8-x86
Introduced in:
0 Fixed in: 14.10.3 Fix
dotnet add package Magick.NET-Q8-x86 --version 14.10.3 References
- https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-pqgj-2p96-rx85 [WEB]
- https://nvd.nist.gov/vuln/detail/CVE-2026-24485 [ADVISORY]
- https://github.com/ImageMagick/ImageMagick/commit/332c1566acc2de77857032d3c2504ead6210ff50 [WEB]
- https://github.com/ImageMagick/ImageMagick [PACKAGE]
- https://github.com/dlemstra/Magick.NET/releases/tag/14.10.3 [WEB]