CVE-2026-45031
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk39th percentile — higher than 39% of all known CVEs
Summary
In ImageMagick prior to versions 6.9.13-47 and 7.1.2-22, a missing check in the PSD decoder allowed bypassing the list-length resource policy when decoding a PSD image. Other security limits still applied.
Risk Assessment
An attacker could exploit this vulnerability by processing a malicious PSD file, potentially leading to excessive resource consumption or service disruption.
Recommendation
Immediately update ImageMagick to version 6.9.13-47 or 7.1.2-22, where the issue has been fixed.
Original NVD description (English source)
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-47 and 7.1.2-22, due to a missing check in the PSD decoder it would be possible to bypass the list-length resource policy when decoding a PSD image. Other security limits would still apply. This issue has been patched in versions 6.9.13-47 and 7.1.2-22.