CVE-2026-24485
📋 TL;DR
This vulnerability in ImageMagick allows attackers to cause denial of service by exploiting an infinite loop in PCD file processing. When ImageMagick processes a specially crafted PCD file without a valid Sync marker, it becomes unresponsive and consumes all CPU resources. This affects all systems running vulnerable versions of ImageMagick that process untrusted image files.
💻 Affected Systems
- ImageMagick
- Magick.NET
- Any software using ImageMagick libraries
📦 What is this software?
Imagemagick by Imagemagick
Imagemagick by Imagemagick
Magick.net by Dlemstra
⚠️ Risk & Real-World Impact
Worst Case
Complete system resource exhaustion leading to system crash or unavailability of services dependent on ImageMagick processing.
Likely Case
Denial of service affecting the ImageMagick process and potentially related services, requiring process termination and system intervention.
If Mitigated
Limited impact to isolated processes with proper resource limits and monitoring in place.
🎯 Exploit Status
Exploitation requires only a specially crafted PCD file. No authentication or special privileges needed if the system processes untrusted image files.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: ImageMagick 7.1.2-15 and 6.9.13-40, Magick.NET 14.10.3
Vendor Advisory: https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-pqgj-2p96-rx85
Restart Required: Yes
Instructions:
1. Update ImageMagick to version 7.1.2-15 or 6.9.13-40. 2. For Magick.NET, update to version 14.10.3. 3. Restart all services and applications using ImageMagick libraries. 4. Verify the update with 'convert --version' or 'magick --version'.
🔧 Temporary Workarounds
Disable PCD format support
allRemove or disable PCD file format support in ImageMagick configuration
Edit policy.xml: <policy domain="coder" rights="none" pattern="PCD" />
Implement resource limits
linuxSet CPU and memory limits for ImageMagick processes
ulimit -t 30 (limits CPU time to 30 seconds)
docker run --cpus="0.5" --memory="512m" ...
🧯 If You Can't Patch
- Implement strict input validation to reject or sanitize PCD files before processing
- Isolate ImageMagick processing in containers with strict resource limits and monitoring
🔍 How to Verify
Check if Vulnerable:
Check ImageMagick version: 'convert --version' or 'magick --version'. If version is below 7.1.2-15 (for ImageMagick 7) or below 6.9.13-40 (for ImageMagick 6), system is vulnerable.Check Version:
convert --version 2>/dev/null || magick --version 2>/dev/null || echo "ImageMagick not found"Verify Fix Applied:
After patching, verify version meets minimum requirements and test processing of known safe PCD files to ensure normal operation.📡 Detection & Monitoring
Log Indicators:
- High CPU usage by ImageMagick processes
- Processes stuck in 'D' (uninterruptible sleep) state
- Repeated timeouts in image processing services
Network Indicators:
- Increased failed image processing requests
- Service degradation in applications using image processing
SIEM Query:
process.name:"convert" OR process.name:"magick" AND (cpu.usage > 90% FOR 5m) OR process.state:"D"