CVE-2026-28692
Received Received - Intake
Heap Over-Read in ImageMagick MAT Decoder Causes Memory Exposure

Publication date: 2026-03-10

Last updated on: 2026-03-11

Assigner: GitHub, Inc.

Description
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-16 and 6.9.13-41, MAT decoder uses 32-bit arithmetic due to incorrect parenthesization resulting in a heap over-read. This vulnerability is fixed in 7.1.2-16 and 6.9.13-41.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-03-10
Last Modified
2026-03-11
Generated
2026-06-16
AI Q&A
2026-03-10
EPSS Evaluated
2026-06-14
NVD
CVE-2026-28692
EUVD
EUVD-2026-10387
Affected Vendors & Products
Showing 2 associated CPEs
Vendor Product Version / Range
imagemagick imagemagick to 6.9.13-41 (exc)
imagemagick imagemagick From 7.0.0-0 (inc) to 7.1.2-16 (exc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-125 The product reads data past the end, or before the beginning, of the intended buffer.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Mitigation Strategies

To mitigate this vulnerability, you should update ImageMagick to a fixed version. The vulnerability is patched in versions 7.1.2-16 and 6.9.13-41.

  • Upgrade ImageMagick to version 7.1.2-16 or later if you are using the 7.x branch.
  • Upgrade ImageMagick to version 6.9.13-41 or later if you are using the 6.x branch.
Compliance Impact

I don't know

Detection Guidance

I don't know

Executive Summary

CVE-2026-28692 is a moderate severity vulnerability in the MAT decoder component of ImageMagick, a software used for editing and manipulating digital images.

The vulnerability arises from incorrect parenthesization in 32-bit arithmetic operations within the MAT decoder, which leads to a 32-bit integer overflow.

This overflow causes a heap buffer over-read, meaning the program reads beyond the allocated memory buffer, potentially causing unexpected behavior or crashes.

The issue has been confirmed by an AddressSanitizer report showing a heap-buffer-overflow error triggered by an 8-byte read at an invalid heap address during decoding.

This vulnerability affects ImageMagick versions prior to 7.1.2-16 and 6.9.13-41 and has been fixed in those versions.

Impact Analysis

This vulnerability can impact you by causing a heap buffer over-read during image decoding, which may lead to application crashes or denial of service.

The CVSS score indicates a low confidentiality impact, no integrity impact, and a low availability impact, meaning sensitive data exposure or data modification is unlikely.

However, since the attack vector is network-based and no privileges or user interaction are required, an attacker could exploit this remotely to disrupt services.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-28692. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart