CVE-2026-28493
published 2026-03-10CVE-2026-28493: ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-16, an integer overflow vulnerability…
PriorityP338medium6.5CVSS 3.1
AVNACHPRNUINSUCNILAH
EPSS
0.33%
25.2th percentile
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-16, an integer overflow vulnerability exists in the SIXEL decoer. The vulnerability allows an attacker to perform an out of bounds via a specially crafted image. This vulnerability is fixed in 7.1.2-16.
Affected
4 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | imagemagick | < imagemagick 8:7.1.2.16+dfsg1-1 (forky) | imagemagick 8:7.1.2.16+dfsg1-1 (forky) |
| imagemagick | imagemagick | < 7.1.2-16 | 7.1.2-16 |
| imagemagick | imagemagick | >= 0 < 8:7.1.1.43+dfsg1-1+deb13u7 | 8:7.1.1.43+dfsg1-1+deb13u7 |
| imagemagick | imagemagick | >= 0 < 8:7.1.2.16+dfsg1-1 | 8:7.1.2.16+dfsg1-1 |
CVSS provenance
nvdv3.16.5MEDIUMCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H
osv6.5MEDIUM
vendor_debian6.5LOW
vendor_redhat6.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
ImageMagick up to 7.1.2-15 SIXEL Decoder integer overflow (EUVD-2026-10371 / Nessus ID 303080)
vuldb·2026-04-21·CVSS 6.5
CVE-2026-28493 [MEDIUM] ImageMagick up to 7.1.2-15 SIXEL Decoder integer overflow (EUVD-2026-10371 / Nessus ID 303080)
A vulnerability, which was classified as critical, has been found in ImageMagick up to 7.1.2-15. The affected element is an unknown function of the component SIXEL Decoder. This manipulation causes integer overflow.
This vulnerability is handled as CVE-2026-28493. The attack can be initiated remotely. There is not any exploit available.
It is advisable to upgrade the affected component.
GHSA
ImageMagick has Integer Overflow leading to out of bounds write in SIXEL decoder
ghsa·2026-03-12
CVE-2026-28493 [MEDIUM] CWE-190 ImageMagick has Integer Overflow leading to out of bounds write in SIXEL decoder
ImageMagick has Integer Overflow leading to out of bounds write in SIXEL decoder
An integer overflow vulnerability exists in the SIXEL decoer. The vulnerability allows an attacker to perform an out of bounds via a specially crafted mage.
OSV
ImageMagick has Integer Overflow leading to out of bounds write in SIXEL decoder
osv·2026-03-12
CVE-2026-28493 [MEDIUM] ImageMagick has Integer Overflow leading to out of bounds write in SIXEL decoder
ImageMagick has Integer Overflow leading to out of bounds write in SIXEL decoder
An integer overflow vulnerability exists in the SIXEL decoer. The vulnerability allows an attacker to perform an out of bounds via a specially crafted mage.
OSV
CVE-2026-28493: ImageMagick is free and open-source software used for editing and manipulating digital images
osv·2026-03-10·CVSS 6.5
CVE-2026-28493 [MEDIUM] CVE-2026-28493: ImageMagick is free and open-source software used for editing and manipulating digital images
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-16, an integer overflow vulnerability exists in the SIXEL decoer. The vulnerability allows an attacker to perform an out of bounds via a specially crafted image. This vulnerability is fixed in 7.1.2-16.
Red Hat
ImageMagick: ImageMagick: Denial of Service and information disclosure via integer overflow in SIXEL decoder
vendor_redhat·2026-03-09·CVSS 6.5
CVE-2026-28493 [MEDIUM] CWE-190 ImageMagick: ImageMagick: Denial of Service and information disclosure via integer overflow in SIXEL decoder
ImageMagick: ImageMagick: Denial of Service and information disclosure via integer overflow in SIXEL decoder
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-16, an integer overflow vulnerability exists in the SIXEL decoer. The vulnerability allows an attacker to perform an out of bounds via a specially crafted image. This vulnerability is fixed in 7.1.2-16.
A flaw was found in ImageMagick. An integer overflow vulnerability exists in the SIXEL decoder, which allows a remote attacker to perform an out-of-bounds write via a specially crafted image. This can lead to a Denial of Service (DoS) and potentially information disclosure.
Statement: This MODERATE impact vulnerability affects ImageMagick in Red Hat Enterprise Lin
Debian
CVE-2026-28493: imagemagick - ImageMagick is free and open-source software used for editing and manipulating d...
vendor_debian·2026·CVSS 6.5
CVE-2026-28493 [MEDIUM] CVE-2026-28493: imagemagick - ImageMagick is free and open-source software used for editing and manipulating d...
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-16, an integer overflow vulnerability exists in the SIXEL decoer. The vulnerability allows an attacker to perform an out of bounds via a specially crafted image. This vulnerability is fixed in 7.1.2-16.
Scope: local
bookworm: resolved
bullseye: resolved
forky: resolved (fixed in 8:7.1.2.16+dfsg1-1)
sid: resolved (fixed in 8:7.1.2.16+dfsg1-1)
trixie: resolved (fixed in 8:7.1.1.43+dfsg1-1+deb13u7)
No detection rules found.
No public exploits indexed.
Wiz
CVE-2026-28493 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz·CVSS 6.5
CVE-2026-28493 [MEDIUM] CVE-2026-28493 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2026-28493 :
C# vulnerability analysis and mitigation
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-16, an integer overflow vulnerability exists in the SIXEL decoer. The vulnerability allows an attacker to perform an out of bounds via a specially crafted image. This vulnerability is fixed in 7.1.2-16.
Source : NVD
## 6.5
Score
Published March 10, 2026
Severity MEDIUM
CNA Score 6.5
Affected Technologies
C#
ImageMagick
Has Public Exploit No
Has CISA KEV Exploit No
CISA KEV Release Date N/A
CISA KEV Due Date N/A
Exploitation Probability Percentile (EPSS) 17.3
Exploitation Probability (EPSS) 0.1
Affected packages and libraries
Magick.NET-Q16-HDRI-OpenMP-arm64
Magick.NET-Q16-HDRI-arm64
Sources
Bugzilla
CVE-2026-28493 ImageMagick: ImageMagick: Denial of Service and information disclosure via integer overflow in SIXEL decoder [fedora-all]
bugzilla·2026-03-10·CVSS 6.5
CVE-2026-28493 [MEDIUM] CVE-2026-28493 ImageMagick: ImageMagick: Denial of Service and information disclosure via integer overflow in SIXEL decoder [fedora-all]
CVE-2026-28493 ImageMagick: ImageMagick: Denial of Service and information disclosure via integer overflow in SIXEL decoder [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Discussion:
This bug appears to have been reported against 'rawhide' during the Fedora Linux 45 development cycle.
Changing version to 45.
2026-03-10
Published