CVE-2026-24481: 
C# vulnerability analysis and mitigation

CVE-2026-24481 is a heap information disclosure vulnerability in ImageMagick's PSD (Adobe Photoshop) format handler, classified as "Possible Heap Information Disclosure in PSD ZIP Decompression." When processing a maliciously crafted PSD file containing ZIP-compressed layer data that decompresses to less than the expected size, uninitialized heap memory is leaked into the output image. The vulnerability affects ImageMagick versions prior to 7.1.2-15 (7.x branch) and prior to 6.9.13-40 (6.x branch), as well as Magick.NET NuGet packages prior to version 14.10.3. It was published on February 23–24, 2026, with a CVSS v3.1 base score of 7.5 (High) (GitHub Advisory, Github Advisory).

The root cause is classified as CWE-125 (Out-of-bounds Read), mapped to CAPEC-540 (Overread Buffers). The PSD format handler in ImageMagick allocates a buffer sized to the expected decompressed output of ZIP-compressed layer data; when the actual decompressed data is smaller than expected, the remaining uninitialized heap memory is not zeroed before being written into the output image, causing it to be disclosed to the caller. Exploitation requires no authentication, no user interaction, and is network-accessible — an attacker simply needs to supply a crafted PSD file to any service or application that processes images using a vulnerable ImageMagick version. The fix is referenced in commit 51c9d33 in the ImageMagick repository (GitHub Advisory, Github Advisory).

Successful exploitation results in the disclosure of uninitialized heap memory contents embedded within the output image, which could expose sensitive data previously stored in server memory — such as cryptographic keys, session tokens, credentials, or other in-memory application data. There is no integrity or availability impact; the vulnerability is purely a confidentiality concern. Systems that accept user-supplied PSD files for processing (e.g., web applications, image conversion services) are at highest risk, as an attacker could retrieve the output image and analyze it for leaked memory contents (GitHub Advisory).

As of the time of publication, there is no public proof-of-concept exploit and no evidence of in-the-wild exploitation (Feedly). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.017% (0.031% per Feedly data), placing it in the 5th percentile for exploitation likelihood within 30 days. The vulnerability is detectable by multiple Nessus and Qualys scanner plugins, indicating broad scanner coverage (Github Advisory).

1. Craft a malicious PSD file: Create a PSD file with a layer that contains ZIP-compressed data (compression type 2 or 3 in PSD format) where the compressed payload decompresses to fewer bytes than the declared/expected layer data size.
2. Submit the file for processing: Deliver the crafted PSD file to a target system running a vulnerable ImageMagick version (< 7.1.2-15 or < 6.9.13-40) — for example, by uploading it to a web application that uses ImageMagick for image conversion or thumbnail generation.
3. Trigger decompression: ImageMagick's PSD handler decompresses the ZIP layer data; because the decompressed output is smaller than the allocated buffer, the remaining uninitialized heap bytes are included in the output image pixel data.
4. Retrieve the output: Obtain the converted/processed output image (e.g., PNG or JPEG) returned by the service.
5. Extract leaked memory: Analyze the output image's pixel data for regions containing uninitialized heap memory, which may include sensitive in-process data such as keys, tokens, or other heap-resident values (GitHub Advisory).

• Network: Unusual uploads of .psd files to image-processing endpoints, particularly files with anomalously small ZIP-compressed layer payloads relative to declared layer dimensions.
• File System: Presence of crafted PSD files with ZIP-compressed layers in upload directories or temporary processing directories.
• Logs: Web server or application logs showing repeated PSD file submissions from the same source IP, especially followed by retrieval of the processed output image; ImageMagick error or warning logs related to PSD decompression size mismatches.
• Process: ImageMagick processes (convert, magick) invoked with PSD input files from untrusted or external sources.

Update ImageMagick to version 7.1.2-15 or later (7.x branch) or 6.9.13-40 or later (6.x branch). For Magick.NET NuGet users, upgrade to version 14.10.3 or later. If immediate patching is not possible, restrict or disable the ability to process PSD files through ImageMagick, implement input validation to reject PSD files before they reach ImageMagick, or disable PSD format support in the ImageMagick policy configuration (/etc/ImageMagick-*/policy.xml). Distribution-specific patches have been issued for Debian, SUSE/openSUSE, Red Hat, Amazon Linux 2, and Ubuntu (GitHub Advisory, Github Advisory).

The advisory was published by ImageMagick maintainer dlemstra on February 23, 2026, and quickly picked up by Linux distribution security teams including Debian, SUSE/openSUSE, Red Hat, Amazon Linux, and Ubuntu, all of which issued security updates. The vulnerability received coverage in Linux security news outlets and was flagged by Tenable Nessus and Qualys scanners shortly after disclosure. No significant independent researcher commentary or social media controversy has been observed beyond routine vulnerability tracking.