CVE-2026-28687

MEDIUM

ImageMagick <7.1.2-16/6.9.13-41 - Use After Free

Title source: llm

Description

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-16 and 6.9.13-41, a heap use-after-free vulnerability in ImageMagick's MSL decoder allows an attacker to trigger access to freed memory by crafting an MSL file. This vulnerability is fixed in 7.1.2-16 and 6.9.13-41.

References (1)

[Vendor Advisory] https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-fpvf-frm6-625q

Scores

CVSS v3 5.3

EPSS 0.0004

EPSS Percentile 12.3%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Classification

CWE

CWE-416

Status published

Affected Products (20)

nuget/Magick.NET-Q16-AnyCPU < 14.10.4NuGet

nuget/Magick.NET-Q16-HDRI-AnyCPU < 14.10.4NuGet

nuget/Magick.NET-Q16-HDRI-OpenMP-arm64 < 14.10.4NuGet

nuget/Magick.NET-Q16-HDRI-arm64 < 14.10.4NuGet

nuget/Magick.NET-Q16-HDRI-x64 < 14.10.4NuGet

nuget/Magick.NET-Q16-HDRI-x86 < 14.10.4NuGet

nuget/Magick.NET-Q16-OpenMP-arm64 < 14.10.4NuGet

nuget/Magick.NET-Q16-OpenMP-x64 < 14.10.4NuGet

nuget/Magick.NET-Q16-OpenMP-x86 < 14.10.4NuGet

nuget/Magick.NET-Q16-arm64 < 14.10.4NuGet

nuget/Magick.NET-Q16-x64 < 14.10.4NuGet

nuget/Magick.NET-Q16-x86 < 14.10.4NuGet

nuget/Magick.NET-Q16-HDRI-OpenMP-x64 < 14.10.4NuGet

nuget/Magick.NET-Q8-AnyCPU < 14.10.4NuGet

nuget/Magick.NET-Q8-OpenMP-arm64 < 14.10.4NuGet

... and 5 more

Timeline

Published Mar 10, 2026

Tracked Since Mar 10, 2026