CVE-2026-28686
Received Received - Intake
Heap Buffer Overflow in ImageMagick PCL Encode Component

Publication date: 2026-03-10

Last updated on: 2026-03-12

Assigner: GitHub, Inc.

Description
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-16 and 6.9.13-41, A heap-buffer-overflow vulnerability exists in the PCL encode due to an undersized output buffer allocation. This vulnerability is fixed in 7.1.2-16 and 6.9.13-41.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-03-10
Last Modified
2026-03-12
Generated
2026-06-16
AI Q&A
2026-03-10
EPSS Evaluated
2026-06-14
NVD
CVE-2026-28686
EUVD
EUVD-2026-10375
Affected Vendors & Products
Showing 2 associated CPEs
Vendor Product Version / Range
imagemagick imagemagick to 6.9.13-41 (exc)
imagemagick imagemagick From 7.0.0-0 (inc) to 7.1.2-16 (exc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-131 The product does not correctly calculate the size to be used when allocating a buffer, which could lead to a buffer overflow.
CWE-122 A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc().
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

[{'type': 'paragraph', 'content': "CVE-2026-28686 is a moderate severity vulnerability in ImageMagick's PCL encoder component. It is a heap-buffer-overflow caused by an undersized output buffer allocation during encoding. This means that the software writes data beyond the allocated memory buffer, which can lead to memory corruption."}, {'type': 'paragraph', 'content': 'The vulnerability is due to incorrect calculation of the buffer size, classified under CWE-122 (Heap-based Buffer Overflow) and CWE-131 (Incorrect Calculation of Buffer Size). It affects versions of ImageMagick prior to 7.1.2-16 and 6.9.13-41.'}] [1]

Impact Analysis

This vulnerability allows a local attacker to cause memory corruption by overflowing a heap buffer. The impact includes potential disruption of system availability and integrity.

  • No confidentiality impact is expected.
  • Integrity impact is low, meaning some data or process integrity could be affected.
  • Availability impact is high, so the system or application could become unavailable or crash.
Compliance Impact

I don't know

Detection Guidance

This vulnerability affects ImageMagick versions prior to 7.1.2-16 and 6.9.13-41. To detect if your system is vulnerable, you should check the installed version of ImageMagick.

  • Run the command `magick -version` or `convert -version` to determine the installed ImageMagick version.
  • If the version is older than 7.1.2-16 or 6.9.13-41, your system is vulnerable to CVE-2026-28686.
Mitigation Strategies

To mitigate this vulnerability, you should upgrade ImageMagick to a patched version.

  • Update ImageMagick to version 7.1.2-16 or later, or 6.9.13-41 or later.
  • Avoid using vulnerable versions of ImageMagick, especially for processing untrusted PCL files.
Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-28686. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart