CVE-2026-28693
Integer Overflow in ImageMagick DIB Coder Causes Memory Corruption
Publication date: 2026-03-10
Last updated on: 2026-03-11
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| imagemagick | imagemagick | to 6.9.13-41 (exc) |
| imagemagick | imagemagick | From 7.0.0-0 (inc) to 7.1.2-16 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-125 | The product reads data past the end, or before the beginning, of the intended buffer. |
| CWE-787 | The product writes data past the end, or before the beginning, of the intended buffer. |
| CWE-190 | The product performs a calculation that can produce an integer overflow or wraparound when the logic assumes that the resulting value will always be larger than the original value. This occurs when an integer value is incremented to a value that is too large to store in the associated representation. When this occurs, the value may become a very small or negative number. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2026-28693 is a high-severity vulnerability in ImageMagick, a software used for editing and manipulating digital images. The issue is caused by an integer overflow in the DIB (Device Independent Bitmap) coder component. This overflow can lead to out-of-bounds memory reads or writes, meaning the software might read or write data outside the allocated memory buffer.
This vulnerability can be exploited remotely without any authentication or user interaction, but it requires complex conditions to be met. It can result in buffer overflows that allow attackers to access or modify data they should not be able to, potentially compromising the system.
How can this vulnerability impact me? :
Exploitation of this vulnerability can have severe impacts including unauthorized access to sensitive data (confidentiality impact), modification of data (integrity impact), and disruption of service (availability impact).
- Remote attackers can exploit this vulnerability without needing any privileges or user interaction.
- It can lead to buffer overflows causing memory corruption.
- Systems processing malicious DIB images may be compromised, affecting the confidentiality, integrity, and availability of those systems.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability affects ImageMagick versions prior to 7.1.2-16 and 6.9.13-41. To detect if your system is vulnerable, you should first check the installed ImageMagick version.
- Run the command `magick -version` or `convert -version` to determine the installed ImageMagick version.
- If the version is older than 7.1.2-16 or 6.9.13-41, your system is vulnerable.
Additionally, monitoring network traffic for suspicious DIB image files being processed or scanning for attempts to exploit the integer overflow in the DIB coder could help detect exploitation attempts, but no specific detection commands are provided.
What immediate steps should I take to mitigate this vulnerability?
The primary mitigation step is to upgrade ImageMagick to a fixed version.
- Update ImageMagick to version 7.1.2-16 or later, or 6.9.13-41 or later, where the integer overflow vulnerability in the DIB coder is patched.
- If immediate upgrade is not possible, consider restricting or disabling processing of untrusted DIB image files to prevent exploitation.
- Implement network-level controls to block or monitor suspicious image file uploads or transfers that could exploit this vulnerability.