CVE-2026-24485CWE-400

ImageMagick: Infinite loop vulnerability when parsing a PCD file

High · published February 24, 2026

CVSS v3.1
7.5
EPSS
1%
Percentile
41.9
In the wild
Unconfirmed
What it is

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, when a PCD file does not contain a valid Sync marker, the DecodeImage() function becomes trapped in an infinite loop while searching for the Sync marker, causing the program to become unresponsive and continuously consume CPU resources, ultimately leading to system resource exhaustion and denial of service. Versions 7.1.2-15 and 6.9.13-40 contain a patch.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.00500 · 41.9th percentile
Weakness
CWE-400 · Uncontrolled Resource Consumption
Published
2026-02-24T00:34Z
EPSS history
Timeline
  • 24 FEB 00:34Z
    ImageMagick: Infinite loop vulnerability when parsing a PCD file
    cvelistv5