Description
Heap-based buffer overflow in the ReadPCXImage function in the PCX coder in coders/pcx.c in (1) ImageMagick 6.2.4-5 and 6.2.8-0 and (2) GraphicsMagick (aka gm) 1.1.7 allows user-assisted remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted .pcx file that triggers incorrect memory allocation for the scanline array, leading to memory corruption.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | graphicsmagick | 1.1.7-13 | — |
| Debian 14 | imagemagick | 7:6.2.4.5.dfsg1-1 | — |
| Debian 13 | graphicsmagick | 1.1.7-13 | — |
| Debian 13 | imagemagick | 7:6.2.4.5.dfsg1-1 | — |
| Debian 12 | graphicsmagick | 1.1.7-13 | — |
| Debian 12 | imagemagick | 7:6.2.4.5.dfsg1-1 | — |
| Debian 5.0 | imagemagick | 7:6.3.7.9.dfsg2-1~lenny3 | DSA-1858-1 |
| Debian 4.0 | imagemagick | 7:6.2.4.5.dfsg1-0.15+etch1 | DSA-1858-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 5 | ImageMagick +4 | 6.2.8.0-4.el5_1.1 | RHSA-2008:0145 |
| RHEL 4 | ImageMagick +4 | 6.0.7.1-17.el4_6.1 | RHSA-2008:0145 |
| RHEL 3 | ImageMagick +4 | 5.5.6-28 | RHSA-2008:0145 |
| RHEL 2 | ImageMagick +4 | 5.3.8-21 | RHSA-2008:0165 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | GraphicsMagick | 1.3.36-1.7 | openSUSE-SU-2024:10596-1 |
Advisories 4
- RHSA-2008:0145 Red Hat Security Advisory: ImageMagick security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2008:0165 Red Hat Security Advisory: ImageMagick security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- DSA-1858-1 imagemagick - several vulnerabilities Debian Security (DSA / DLA) · Mar 9, 2026
- openSUSE-SU-2024:10596-1 GraphicsMagick-1.3.36-1.7 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
References
- GLSA-201311-10 vendor-advisory
- 28822 vdb-entry
- https://bugzilla.redhat.com/show_bug.cgi?id=285861
- 29857 third-party-advisory
- RHSA-2008:0145 vendor-advisory
- 43213 vdb-entry
- 1019881 vdb-entry
- 55721 third-party-advisory
- 29786 third-party-advisory
- http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=413034
- 30967 third-party-advisory
- oval:org.mitre.oval:def:11237 vdb-entry signature
- RHSA-2008:0165 vendor-advisory
- SUSE-SR:2008:014 vendor-advisory
- MDVSA-2008:099 vendor-advisory
- DSA-1858 vendor-advisory
- imagemagick-readpcximage-bo(41193) vdb-entry
- 36260 third-party-advisory