Is CVE-2026-28693 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-28693 being exploited in the wild.

How severe is CVE-2026-28693?

High severity, with a CVSS score of 8.1, published 10 March 2026.

Which products and versions are affected?

Magick.NET-Q16-AnyCPU (NuGet) ECOSYSTEM:introduced=0,fixed=14.10.4; Magick.NET-Q16-arm64 (NuGet) ECOSYSTEM:introduced=0,fixed=14.10.4; Magick.NET-Q16-HDRI-AnyCPU (NuGet) ECOSYSTEM:introduced=0,fixed=14.10.4; Magick.NET-Q16-HDRI-arm64 (NuGet) ECOSYSTEM:introduced=0,fixed=14.10.4; and 15 more.

Is there a fix for CVE-2026-28693?

Yes. Magick.NET-Q16-AnyCPU (NuGet): upgrade to 14.10.4 or later; Magick.NET-Q16-arm64 (NuGet): upgrade to 14.10.4 or later; Magick.NET-Q16-HDRI-AnyCPU (NuGet): upgrade to 14.10.4 or later; Magick.NET-Q16-HDRI-arm64 (NuGet): upgrade to 14.10.4 or later; Magick.NET-Q16-HDRI-OpenMP-arm64 (NuGet): upgrade to 14.10.4 or later; Magick.NET-Q16-HDRI-OpenMP-x64 (NuGet): upgrade to 14.10.4 or later; Magick.NET-Q16-HDRI-x64 (NuGet): upgrade to 14.10.4 or later; Magick.NET-Q16-HDRI-x86 (NuGet): upgrade to 14.10.4 or later; Magick.NET-Q16-OpenMP-arm64 (NuGet): upgrade to 14.10.4 or later; Magick.NET-Q16-OpenMP-x64 (NuGet): upgrade to 14.10.4 or later; Magick.NET-Q16-OpenMP-x86 (NuGet): upgrade to 14.10.4 or later; Magick.NET-Q16-x64 (NuGet): upgrade to 14.10.4 or later; Magick.NET-Q16-x86 (NuGet): upgrade to 14.10.4 or later; Magick.NET-Q8-AnyCPU (NuGet): upgrade to 14.10.4 or later; Magick.NET-Q8-arm64 (NuGet): upgrade to 14.10.4 or later; Magick.NET-Q8-OpenMP-arm64 (NuGet): upgrade to 14.10.4 or later; Magick.NET-Q8-OpenMP-x64 (NuGet): upgrade to 14.10.4 or later; Magick.NET-Q8-x64 (NuGet): upgrade to 14.10.4 or later; Magick.NET-Q8-x86 (NuGet): upgrade to 14.10.4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-28693 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-28693?

Check whether you run Magick.NET-Q16-AnyCPU (NuGet), Magick.NET-Q16-arm64 (NuGet), Magick.NET-Q16-HDRI-AnyCPU (NuGet) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-28693: ImageMagick integer overflow in DIB coder

CVE-2026-28693 · Severity: high · CVSS 8.1 · Published 2026-03-10

ImageMagick is a widely used open-source tool for processing and editing digital images. A security flaw has been identified where a specially crafted image file can cause the software to crash or potentially allow unauthorized access to data. This could lead to service disruptions or the exposure of sensitive information on systems that use ImageMagick to process user-uploaded images.

Quick answers

Is CVE-2026-28693 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-28693 being exploited in the wild.
How severe is CVE-2026-28693?: High severity, with a CVSS score of 8.1, published 10 March 2026.
Which products and versions are affected?: Magick.NET-Q16-AnyCPU (NuGet) ECOSYSTEM:introduced=0,fixed=14.10.4; Magick.NET-Q16-arm64 (NuGet) ECOSYSTEM:introduced=0,fixed=14.10.4; Magick.NET-Q16-HDRI-AnyCPU (NuGet) ECOSYSTEM:introduced=0,fixed=14.10.4; Magick.NET-Q16-HDRI-arm64 (NuGet) ECOSYSTEM:introduced=0,fixed=14.10.4; and 15 more.
Is there a fix for CVE-2026-28693?: Yes. Magick.NET-Q16-AnyCPU (NuGet): upgrade to 14.10.4 or later; Magick.NET-Q16-arm64 (NuGet): upgrade to 14.10.4 or later; Magick.NET-Q16-HDRI-AnyCPU (NuGet): upgrade to 14.10.4 or later; Magick.NET-Q16-HDRI-arm64 (NuGet): upgrade to 14.10.4 or later; Magick.NET-Q16-HDRI-OpenMP-arm64 (NuGet): upgrade to 14.10.4 or later; Magick.NET-Q16-HDRI-OpenMP-x64 (NuGet): upgrade to 14.10.4 or later; Magick.NET-Q16-HDRI-x64 (NuGet): upgrade to 14.10.4 or later; Magick.NET-Q16-HDRI-x86 (NuGet): upgrade to 14.10.4 or later; Magick.NET-Q16-OpenMP-arm64 (NuGet): upgrade to 14.10.4 or later; Magick.NET-Q16-OpenMP-x64 (NuGet): upgrade to 14.10.4 or later; Magick.NET-Q16-OpenMP-x86 (NuGet): upgrade to 14.10.4 or later; Magick.NET-Q16-x64 (NuGet): upgrade to 14.10.4 or later; Magick.NET-Q16-x86 (NuGet): upgrade to 14.10.4 or later; Magick.NET-Q8-AnyCPU (NuGet): upgrade to 14.10.4 or later; Magick.NET-Q8-arm64 (NuGet): upgrade to 14.10.4 or later; Magick.NET-Q8-OpenMP-arm64 (NuGet): upgrade to 14.10.4 or later; Magick.NET-Q8-OpenMP-x64 (NuGet): upgrade to 14.10.4 or later; Magick.NET-Q8-x64 (NuGet): upgrade to 14.10.4 or later; Magick.NET-Q8-x86 (NuGet): upgrade to 14.10.4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-28693 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-28693?: Check whether you run Magick.NET-Q16-AnyCPU (NuGet), Magick.NET-Q16-arm64 (NuGet), Magick.NET-Q16-HDRI-AnyCPU (NuGet) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Magick.NET-Q16-AnyCPU (NuGet): upgrade to 14.10.4 or later

dotnet add package Magick.NET-Q16-AnyCPU --version 14.10.4

Magick.NET-Q16-arm64 (NuGet): upgrade to 14.10.4 or later

dotnet add package Magick.NET-Q16-arm64 --version 14.10.4

Magick.NET-Q16-HDRI-AnyCPU (NuGet): upgrade to 14.10.4 or later

dotnet add package Magick.NET-Q16-HDRI-AnyCPU --version 14.10.4

Magick.NET-Q16-HDRI-arm64 (NuGet): upgrade to 14.10.4 or later

dotnet add package Magick.NET-Q16-HDRI-arm64 --version 14.10.4

Magick.NET-Q16-HDRI-OpenMP-arm64 (NuGet): upgrade to 14.10.4 or later

dotnet add package Magick.NET-Q16-HDRI-OpenMP-arm64 --version 14.10.4

Magick.NET-Q16-HDRI-OpenMP-x64 (NuGet): upgrade to 14.10.4 or later

dotnet add package Magick.NET-Q16-HDRI-OpenMP-x64 --version 14.10.4

Magick.NET-Q16-HDRI-x64 (NuGet): upgrade to 14.10.4 or later

dotnet add package Magick.NET-Q16-HDRI-x64 --version 14.10.4

Magick.NET-Q16-HDRI-x86 (NuGet): upgrade to 14.10.4 or later

dotnet add package Magick.NET-Q16-HDRI-x86 --version 14.10.4

Magick.NET-Q16-OpenMP-arm64 (NuGet): upgrade to 14.10.4 or later

dotnet add package Magick.NET-Q16-OpenMP-arm64 --version 14.10.4

Magick.NET-Q16-OpenMP-x64 (NuGet): upgrade to 14.10.4 or later

dotnet add package Magick.NET-Q16-OpenMP-x64 --version 14.10.4

Magick.NET-Q16-OpenMP-x86 (NuGet): upgrade to 14.10.4 or later

dotnet add package Magick.NET-Q16-OpenMP-x86 --version 14.10.4

Magick.NET-Q16-x64 (NuGet): upgrade to 14.10.4 or later

dotnet add package Magick.NET-Q16-x64 --version 14.10.4

Magick.NET-Q16-x86 (NuGet): upgrade to 14.10.4 or later

dotnet add package Magick.NET-Q16-x86 --version 14.10.4

Magick.NET-Q8-AnyCPU (NuGet): upgrade to 14.10.4 or later

dotnet add package Magick.NET-Q8-AnyCPU --version 14.10.4

Magick.NET-Q8-arm64 (NuGet): upgrade to 14.10.4 or later

dotnet add package Magick.NET-Q8-arm64 --version 14.10.4

Magick.NET-Q8-OpenMP-arm64 (NuGet): upgrade to 14.10.4 or later

dotnet add package Magick.NET-Q8-OpenMP-arm64 --version 14.10.4

Magick.NET-Q8-OpenMP-x64 (NuGet): upgrade to 14.10.4 or later

dotnet add package Magick.NET-Q8-OpenMP-x64 --version 14.10.4

Magick.NET-Q8-x64 (NuGet): upgrade to 14.10.4 or later

dotnet add package Magick.NET-Q8-x64 --version 14.10.4

Magick.NET-Q8-x86 (NuGet): upgrade to 14.10.4 or later

dotnet add package Magick.NET-Q8-x86 --version 14.10.4

Technical details

An integer overflow vulnerability exists in the DIB (Device Independent Bitmap) coder component of ImageMagick. The flaw occurs during the processing of DIB files, where improper calculation of buffer sizes leads to out-of-bounds (OOB) read or write operations. An attacker can exploit this by providing a maliciously crafted image file. While the attack complexity is rated as high (likely requiring specific memory layouts or conditions), successful exploitation can result in a loss of confidentiality, integrity, and availability. The issue is resolved in versions 7.1.2-16 and 6.9.13-41.

Affected products

ImageMagick ImageMagick < 7.1.2-16, < 6.9.13-41
Red Hat Red Hat Enterprise Linux Server (v. 7 ELS) 7

Identifiers

CVE-2026-28693
GHSA-hffp-q43q-qq76

Timeline

2026-03-09: advisory: GitHub Security Advisory published
2026-03-10: disclosed: CVE-2026-28693 published to NVD
2026-04-06: patched: Red Hat released security updates (RHSA-2026:6713)

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.