CVE-2026-24485
Publication date 24 February 2026
Last updated 13 May 2026
Ubuntu priority
Description
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, when a PCD file does not contain a valid Sync marker, the DecodeImage() function becomes trapped in an infinite loop while searching for the Sync marker, causing the program to become unresponsive and continuously consume CPU resources, ultimately leading to system resource exhaustion and denial of service. Versions 7.1.2-15 and 6.9.13-40 contain a patch.
Status
| Package | Ubuntu Release | Status |
|---|---|---|
| imagemagick | 26.04 LTS resolute |
Not affected
|
| 25.10 questing |
Fixed 8:7.1.2.3+dfsg1-1ubuntu0.1
|
|
| 24.04 LTS noble |
Fixed 8:6.9.12.98+dfsg1-5.2ubuntu0.1~esm9
|
|
| 22.04 LTS jammy |
Fixed 8:6.9.11.60+dfsg-1.3ubuntu0.22.04.5+esm10
|
|
| 20.04 LTS focal |
Fixed 8:6.9.10.23+dfsg-2.1ubuntu11.11+esm10
|
|
| 18.04 LTS bionic |
Fixed 8:6.9.7.4+dfsg-16ubuntu6.15+esm12
|
|
| 16.04 LTS xenial |
Fixed 8:6.8.9.9-7ubuntu5.16+esm20
|
|
| 14.04 LTS trusty |
Fixed 8:6.7.7.10-6ubuntu3.13+esm21
|
Get expanded security coverage with Ubuntu Pro
Reduce your average CVE exposure time from 98 days to 1 day with expanded CVE patching, ten-years security maintenance and optional support for the full stack of open-source applications. Free for personal use.
Get Ubuntu Pro 30-day free trialPatch details
| Package | Patch details |
|---|---|
| imagemagick |
Severity score breakdown
| Parameter | Value |
|---|---|
| Base score |
7.5 · High
|
| Attack vector | Network |
| Attack complexity | Low |
| Privileges required | None |
| User interaction | None |
| Scope | Unchanged |
| Confidentiality | None |
| Integrity impact | None |
| Availability impact | High |
| Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
References
Related Ubuntu Security Notices (USN)
- USN-8263-1
- ImageMagick vulnerabilities
- 11 May 2026