CVE-2026-28692 — Out-of-bounds Read in Imagemagick

CWE-125 — Out-of-bounds ReadCWE-190 — Integer Overflow or Wraparound8 documents7 sources
Severity
4.8MEDIUMNVD
EPSS
0.0%
top 93.91%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Imagemagick
Timeline
PublishedMar 10

Description

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-16 and 6.9.13-41, MAT decoder uses 32-bit arithmetic due to incorrect parenthesization resulting in a heap over-read. This vulnerability is fixed in 7.1.2-16 and 6.9.13-41.

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:LExploitability: 2.2 | Impact: 2.5

Affected Packages3 packages

▶CVEListV5imagemagick/imagemagick< 6.9.13-41+1
▶NVDimagemagick/imagemagick7.0.0-0 — 7.1.2-16+1
▶Debianimagemagick/imagemagick< 8:7.1.1.43+dfsg1-1+deb13u7+1

🔴Vulnerability Details

4
GHSA
ImageMagick has a heap buffer over-read via 32-bit integer overflow in MAT decoder↗2026-03-10
▶
OSV
ImageMagick has a heap buffer over-read via 32-bit integer overflow in MAT decoder↗2026-03-10
▶
OSV
CVE-2026-28692: ImageMagick is free and open-source software used for editing and manipulating digital images↗2026-03-10
▶
CVEList
ImageMagick has a heap buffer over-read via 32-bit integer overflow in MAT decoder↗2026-03-09
▶

📋Vendor Advisories

2
Red Hat
ImageMagick: ImageMagick: Information disclosure and denial of service via heap over-read in MAT decoder↗2026-03-09
▶
Debian
CVE-2026-28692: imagemagick - ImageMagick is free and open-source software used for editing and manipulating d...↗2026
▶

🕵️Threat Intelligence

1
Wiz
CVE-2026-28692 Impact, Exploitability, and Mitigation Steps | Wiz↗
▶