Back to list

ImageMagick: Policy Bypass in PSD decoder — CVE-2026-45031

GitHub · GitHub · CVE-2026-45031

ID
CVE-2026-45031
Date
Activity
Source
GitHub
Vendor
GitHub
Threat
medium
CVSS
5.3

Summary

Due to a missing check in the PSD decoder it would be possible to bypass the `list-length` resource policy when decoding a PSD image. Other security limits would still apply.

Product

nuget: Magick.NET-Q16-AnyCPU | nuget: Magick.NET-Q16-HDRI-AnyCPU | nuget: Magick.NET-Q16-HDRI-OpenMP-arm64 | nuget: Magick.NET-Q16-HDRI-OpenMP-x64 | nuget: Magick.NET-Q16-HDRI-arm64 | nuget: Magick.NET-Q16-HDRI-x64 | nuget: Magick.NET-Q16-HDRI-x86 | nuget: Magick.NET-Q16-OpenMP-arm64 | +10

What to do

General, cautious steps (verify details in the official source):

  • Review exposure and plan remediation based on risk and environment.
  • Identify affected product versions in your inventory and verify whether you are impacted.
  • Apply vendor patches/updates or recommended mitigations as soon as available.
  • Read the official advisory for exact affected versions and remediation steps.

Official advisory

Related advisories

GitHub GitHub 2026-W21