CVE-2026-28691: ImageMagick uninitialized pointer dereference in JBIG decoder

CVE-2026-28691 · Severity: high · CVSS 7.5 · Published 2026-03-10

ImageMagick, a widely used tool for processing and editing digital images, is vulnerable to a flaw that can cause the software to crash. By providing a specially crafted image file, an attacker can trigger a service outage, potentially disrupting automated workflows or web services that rely on this tool for image processing. This issue affects various versions of the software and has been addressed in recent security updates.

Technologies: ImageMagick, Magick.NET-Q16-AnyCPU (NuGet), Magick.NET-Q16-arm64 (NuGet), Magick.NET-Q16-HDRI-AnyCPU (NuGet), Magick.NET-Q16-HDRI-arm64 (NuGet), Magick.NET-Q16-HDRI-OpenMP-arm64 (NuGet), Magick.NET-Q16-HDRI-OpenMP-x64 (NuGet), Magick.NET-Q16-HDRI-x64 (NuGet), Magick.NET-Q16-HDRI-x86 (NuGet), Magick.NET-Q16-OpenMP-arm64 (NuGet), Magick.NET-Q16-OpenMP-x64 (NuGet), Magick.NET-Q16-OpenMP-x86 (NuGet), Magick.NET-Q16-x64 (NuGet), Magick.NET-Q16-x86 (NuGet), Magick.NET-Q8-AnyCPU (NuGet), Magick.NET-Q8-arm64 (NuGet), Magick.NET-Q8-OpenMP-arm64 (NuGet), Magick.NET-Q8-OpenMP-x64 (NuGet), Magick.NET-Q8-x64 (NuGet), Magick.NET-Q8-x86 (NuGet). Vendors: ImageMagick, NuGet.

Quick answers

Is CVE-2026-28691 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-28691 being exploited in the wild.
How severe is CVE-2026-28691?
High severity, with a CVSS score of 7.5, published 10 March 2026.
Which products and versions are affected?
ImageMagick < 7.1.2-16, < 6.9.13-41; Magick.NET-Q16-AnyCPU (NuGet) ECOSYSTEM:introduced=0,fixed=14.10.4; Magick.NET-Q16-arm64 (NuGet) ECOSYSTEM:introduced=0,fixed=14.10.4; Magick.NET-Q16-HDRI-AnyCPU (NuGet) ECOSYSTEM:introduced=0,fixed=14.10.4; and 16 more.
Is there a fix for CVE-2026-28691?
Yes. Magick.NET-Q16-AnyCPU (NuGet): upgrade to 14.10.4 or later; Magick.NET-Q16-arm64 (NuGet): upgrade to 14.10.4 or later; Magick.NET-Q16-HDRI-AnyCPU (NuGet): upgrade to 14.10.4 or later; Magick.NET-Q16-HDRI-arm64 (NuGet): upgrade to 14.10.4 or later; Magick.NET-Q16-HDRI-OpenMP-arm64 (NuGet): upgrade to 14.10.4 or later; Magick.NET-Q16-HDRI-OpenMP-x64 (NuGet): upgrade to 14.10.4 or later; Magick.NET-Q16-HDRI-x64 (NuGet): upgrade to 14.10.4 or later; Magick.NET-Q16-HDRI-x86 (NuGet): upgrade to 14.10.4 or later; Magick.NET-Q16-OpenMP-arm64 (NuGet): upgrade to 14.10.4 or later; Magick.NET-Q16-OpenMP-x64 (NuGet): upgrade to 14.10.4 or later; Magick.NET-Q16-OpenMP-x86 (NuGet): upgrade to 14.10.4 or later; Magick.NET-Q16-x64 (NuGet): upgrade to 14.10.4 or later; Magick.NET-Q16-x86 (NuGet): upgrade to 14.10.4 or later; Magick.NET-Q8-AnyCPU (NuGet): upgrade to 14.10.4 or later; Magick.NET-Q8-arm64 (NuGet): upgrade to 14.10.4 or later; Magick.NET-Q8-OpenMP-arm64 (NuGet): upgrade to 14.10.4 or later; Magick.NET-Q8-OpenMP-x64 (NuGet): upgrade to 14.10.4 or later; Magick.NET-Q8-x64 (NuGet): upgrade to 14.10.4 or later; Magick.NET-Q8-x86 (NuGet): upgrade to 14.10.4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-28691 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-28691?
Check whether you run ImageMagick, Magick.NET-Q16-AnyCPU (NuGet), Magick.NET-Q16-arm64 (NuGet) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • Magick.NET-Q16-AnyCPU (NuGet): upgrade to 14.10.4 or later
    dotnet add package Magick.NET-Q16-AnyCPU --version 14.10.4
  • Magick.NET-Q16-arm64 (NuGet): upgrade to 14.10.4 or later
    dotnet add package Magick.NET-Q16-arm64 --version 14.10.4
  • Magick.NET-Q16-HDRI-AnyCPU (NuGet): upgrade to 14.10.4 or later
    dotnet add package Magick.NET-Q16-HDRI-AnyCPU --version 14.10.4
  • Magick.NET-Q16-HDRI-arm64 (NuGet): upgrade to 14.10.4 or later
    dotnet add package Magick.NET-Q16-HDRI-arm64 --version 14.10.4
  • Magick.NET-Q16-HDRI-OpenMP-arm64 (NuGet): upgrade to 14.10.4 or later
    dotnet add package Magick.NET-Q16-HDRI-OpenMP-arm64 --version 14.10.4
  • Magick.NET-Q16-HDRI-OpenMP-x64 (NuGet): upgrade to 14.10.4 or later
    dotnet add package Magick.NET-Q16-HDRI-OpenMP-x64 --version 14.10.4
  • Magick.NET-Q16-HDRI-x64 (NuGet): upgrade to 14.10.4 or later
    dotnet add package Magick.NET-Q16-HDRI-x64 --version 14.10.4
  • Magick.NET-Q16-HDRI-x86 (NuGet): upgrade to 14.10.4 or later
    dotnet add package Magick.NET-Q16-HDRI-x86 --version 14.10.4
  • Magick.NET-Q16-OpenMP-arm64 (NuGet): upgrade to 14.10.4 or later
    dotnet add package Magick.NET-Q16-OpenMP-arm64 --version 14.10.4
  • Magick.NET-Q16-OpenMP-x64 (NuGet): upgrade to 14.10.4 or later
    dotnet add package Magick.NET-Q16-OpenMP-x64 --version 14.10.4
  • Magick.NET-Q16-OpenMP-x86 (NuGet): upgrade to 14.10.4 or later
    dotnet add package Magick.NET-Q16-OpenMP-x86 --version 14.10.4
  • Magick.NET-Q16-x64 (NuGet): upgrade to 14.10.4 or later
    dotnet add package Magick.NET-Q16-x64 --version 14.10.4
  • Magick.NET-Q16-x86 (NuGet): upgrade to 14.10.4 or later
    dotnet add package Magick.NET-Q16-x86 --version 14.10.4
  • Magick.NET-Q8-AnyCPU (NuGet): upgrade to 14.10.4 or later
    dotnet add package Magick.NET-Q8-AnyCPU --version 14.10.4
  • Magick.NET-Q8-arm64 (NuGet): upgrade to 14.10.4 or later
    dotnet add package Magick.NET-Q8-arm64 --version 14.10.4
  • Magick.NET-Q8-OpenMP-arm64 (NuGet): upgrade to 14.10.4 or later
    dotnet add package Magick.NET-Q8-OpenMP-arm64 --version 14.10.4
  • Magick.NET-Q8-OpenMP-x64 (NuGet): upgrade to 14.10.4 or later
    dotnet add package Magick.NET-Q8-OpenMP-x64 --version 14.10.4
  • Magick.NET-Q8-x64 (NuGet): upgrade to 14.10.4 or later
    dotnet add package Magick.NET-Q8-x64 --version 14.10.4
  • Magick.NET-Q8-x86 (NuGet): upgrade to 14.10.4 or later
    dotnet add package Magick.NET-Q8-x86 --version 14.10.4

Technical details

An uninitialized pointer dereference vulnerability exists in ImageMagick's JBIG decoder due to a missing check on return values (CWE-252, CWE-824). A remote, unauthenticated attacker can exploit this by providing a malformed JBIG image file for processing, leading to an application crash and denial of service (DoS). The vulnerability is reachable over the network if the application processes user-supplied images. Patches are available in ImageMagick versions 7.1.2-16 and 6.9.13-41, and Red Hat has released updates for affected Enterprise Linux distributions.

Affected products

  • ImageMagick ImageMagick < 7.1.2-16, < 6.9.13-41
  • Red Hat Red Hat Enterprise Linux Server (v. 7 ELS) 7

Identifiers

  • CVE-2026-28691
  • GHSA-wj8w-pjxf-9g4f

Timeline

  • 2026-03-09: disclosed: Initial report and GitHub advisory publication
  • 2026-03-10: advisory: NVD publication date
  • 2026-04-06: patched: Red Hat released security updates (RHSA-2026:6713)

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.