mageMagick has a possible use-after-free write in its PDB decoder

Description

==4033155==ERROR: AddressSanitizer: UNKNOWN SIGNAL on unknown address 0x000000000000 (pc 0x5589c1971b24 bp 0x7ffdcc7ae2d0 sp 0x7ffdcc7adb20 T0)

==4034812==ERROR: AddressSanitizer: heap-use-after-free on address 0x7f099e9f7800 at pc 0x5605d909ab20 bp 0x7ffe52045b50 sp 0x7ffe52045b40
WRITE of size 1 at 0x7f099e9f7800 thread T0

References

• ImageMagick/ImageMagick security advisory · WEB
• ImageMagick/ImageMagick commit 168ffe1 · WEB
• ImageMagick/ImageMagick · PACKAGE
• dlemstra/Magick.NET release 14.10.3 · WEB
• vulncheck.com/advisories/imagemagick-use-after-free-write-in-pdb-decoder · Third Party Advisory

Altre vulnerabilità di Magick.NET-Q16-AnyCPU

• CVE-2026-62946MEDIO 4.7ImageMagick is free and open-source software used for editing and manipulating digital images. In versions prior to both 6.9.13-52 and 7.1.2…
• CVE-2026-62363MEDIO 5.0ImageMagick is free and open-source software used for editing and manipulating digital images. In versions prior to 7.1.2-27, a heap buffer …
• CVE-2026-62343MEDIO 4.7ImageMagick is free and open-source software used for editing and manipulating digital images. In versions prior to 6.9.13-51 and 7.0.1-0 an…
• CVE-2026-66011BASSO 3.3ImageMagick before 7.1.2-27 contains a memory leak vulnerability in the magick command-line interface when invalid options are provided. Att…
• GHSA-hc76-7mpc-qjqhMEDIO 5.7ImageMagick: Code injection in HTML encoder due to incomplete fix of CVE-2026-25797