CVE-2026-28692
Plain English Summary
AI-powered analysis for quick understanding
This vulnerability allows an attacker to potentially read sensitive data from the memory of a system running vulnerable versions of ImageMagick when processing specially crafted image files. To exploit this, the attacker must be able to upload or manipulate images that the software will decode, which could lead to unauthorized access to information.
Technical Description
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-16 and 6.9.13-41, MAT decoder uses 32-bit arithmetic due to incorrect parenthesization resulting in a heap over-read. This vulnerability is fixed in 7.1.2-16 and 6.9.13-41.
CVSS Vector Analysis
Vector String
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:LExploit Resources
Search for proof-of-concept code and exploit modules
Official References
Quick Information
Published
Mar 10, 2026
29 days ago
Last Modified
Mar 11, 2026
27 days ago
Vendor
imagemagick
Product
imagemagick
Related Vulnerabilities
An attacker can create a specially crafted image that, when processed by vulnerable versions of ImageMagick using the wavelet denoise feature, can lead to unintended memory changes, potentially allowing them to execute arbitrary code. This issue affects versions prior to 7.1.2-16 and 6.9.13-41, so updating to these versions or later is essential to mitigate the risk.
This vulnerability allows an attacker to cause an application using ImageMagick to read data from memory that it shouldn't, potentially exposing sensitive information. It occurs when processing specially crafted images with the bilateral blur feature, and it affects versions prior to 7.1.2-16.
This vulnerability allows an attacker to exploit a flaw in ImageMagick's UHDR encoder, potentially leading to unauthorized access or control over the system by writing data outside the intended memory space. It affects versions prior to 7.1.2-16, so users must upgrade to this version or later to protect against this risk.
This vulnerability allows an attacker to crash the ImageMagick software or potentially execute malicious code by sending a specially crafted image that overflows a fixed-size memory area. It affects versions prior to 7.1.2-16 and 6.9.13-41, so users should update to these versions or later to protect against this risk.
This vulnerability allows an attacker to crash the ImageMagick software or potentially execute harmful code by sending a specially crafted PNG image with an excessively large profile. It affects versions prior to 7.1.2-16 and 6.9.13-41, so using an updated version is crucial to avoid exploitation.