3.7

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-25984

CVE-2026-25984: ImageMagick: Integer Overflow in PSB (PSD v2) RLE decoding path causes heap Out of Bounds reads for 32-bit builds

An integer overflow in the PSB (PSD v2) RLE decoding path causes a heap out-of-bounds read on 32-bit builds. This can lead to information disclosure or a crash when processing crafted PSB files.

=================================================================
==3298==ERROR: AddressSanitizer: heap-buffer-overflow on address 0xf512eb00 at pc 0xf76760b5 bp 0xffc1dfb8 sp 0xffc1dfa8
READ of size 8 at 0xf512eb00 thread T0
    #0 0xf76760b4 in ReadPSDChannelRLE coders/psd.c:1141

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-25984

CVE-2026-25984:

3.7

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
Magick.NET-Q16-AnyCPU	nuget	< 14.10.3	14.10.3
Magick.NET-Q16-HDRI-AnyCPU	nuget	< 14.10.3	14.10.3
Magick.NET-Q16-HDRI-OpenMP-arm64	nuget	< 14.10.3	14.10.3
Magick.NET-Q16-HDRI-OpenMP-x64	nuget	< 14.10.3	14.10.3
Magick.NET-Q16-HDRI-arm64	nuget	< 14.10.3	14.10.3
Magick.NET-Q16-HDRI-x64	nuget	< 14.10.3	14.10.3
Magick.NET-Q16-HDRI-x86	nuget	< 14.10.3	14.10.3
Magick.NET-Q16-OpenMP-arm64	nuget	< 14.10.3	14.10.3
Magick.NET-Q16-OpenMP-x64	nuget	< 14.10.3	14.10.3
Magick.NET-Q16-OpenMP-x86	nuget	< 14.10.3	14.10.3
Magick.NET-Q16-arm64	nuget	< 14.10.3	14.10.3
Magick.NET-Q16-x64	nuget	< 14.10.3	14.10.3
Magick.NET-Q16-x86	nuget	< 14.10.3	14.10.3
Magick.NET-Q8-AnyCPU	nuget	< 14.10.3	14.10.3
Magick.NET-Q8-OpenMP-arm64	nuget	< 14.10.3	14.10.3
Magick.NET-Q8-OpenMP-x64	nuget	< 14.10.3	14.10.3
Magick.NET-Q8-arm64	nuget	< 14.10.3	14.10.3
Magick.NET-Q8-x64	nuget	< 14.10.3	14.10.3
Magick.NET-Q8-x86	nuget	< 14.10.3	14.10.3

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is an integer overflow within the ReadPSDMergedImage function in coders/psd.c. Specifically, the multiplication of image->rows and psd_info->channels to determine the size of a buffer for RLE scanline data can overflow on 32-bit systems. This results in the allocation of an undersized buffer. The allocated buffer is subsequently used by the ReadPSDChannelRLE function, which is where the program crashes due to a heap out-of-bounds read, as evidenced by the provided stack trace. The patch addresses the root cause by adding an integer overflow check (HeapOverflowSanityCheckGetSize) in ReadPSDMergedImage before the buffer size is calculated and the allocation occurs. Therefore, both ReadPSDMergedImage (where the overflow originates) and ReadPSDChannelRLE (where the crash manifests) are critical functions that would appear in a runtime profile during exploitation.

Vulnerable functions

ReadPSDMergedImage

coders/psd.c

This function calculates the size for RLE scanline data by multiplying `image->rows` and `psd_info->channels`. On 32-bit systems, this multiplication can lead to an integer overflow, resulting in a smaller-than-expected buffer being allocated. This leads to a heap-based buffer overflow when the buffer is later used.

ReadPSDChannelRLE

coders/psd.c

This function is identified as the location of the crash (heap-buffer-overflow) from the vulnerability description's stack trace. It performs an out-of-bounds read when processing RLE compressed data from a crafted PSB file, likely due to operating on a buffer that was allocated with an incorrect size due to an integer overflow in `ReadPSDMergedImage`.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.