Description
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-16 and 6.9.13-41, a heap-use-after-free vulnerability exists in the MSL encoder, where a cloned image is destroyed twice. The MSL coder does not support writing MSL so the write capability has been removed. This vulnerability is fixed in 7.1.2-16 and 6.9.13-41.
Published: 2026-03-09
Score: 4 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Heap-Use-After-Free
Action: Immediate Patch
AI Analysis

Impact

A heap-use-after-free flaw exists in ImageMagick’s MSL encoder that frees a cloned image twice. The vulnerability is associated with CWE‑416 and may cause memory corruption when the MSL image is processed. The advisory does not explicitly state a crash or arbitrary code execution, only that undefined behavior can result.

Affected Systems

The flaw affects ImageMagick versions earlier than 7.1.2‑16 and 6.9.13‑41. Users of the ImageMagick software stack who rely on the MSL encoder are at risk.

Risk and Exploitability

The CVSS score of 4 indicates a moderate severity. The EPSS score is below 1% and the vulnerability is not listed in KEV, suggesting a low likelihood of widespread exploitation. An attacker would need to supply a crafted MSL image to trigger the issue, potentially during image processing by any software that uses the MSL encoder.

Generated by OpenCVE AI on April 18, 2026 at 09:40 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade ImageMagick to 7.1.2‑16 or 6.9.13‑41, the versions in which the MSL encoder issue is fixed.
  • Disable MSL image format support in your application to prevent the vulnerable encoder from being invoked.
  • Implement input validation to reject or block MSL images before they reach the image processing pipeline.

Generated by OpenCVE AI on April 18, 2026 at 09:40 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Debian DLA Debian DLA DLA-4539-1 imagemagick security update
Debian DSA Debian DSA DSA-6169-1 imagemagick security update
Debian DSA Debian DSA DSA-6210-1 imagemagick security update
Github GHSA Github GHSA GHSA-xxw5-m53x-j38c ImageMagick has heap use-after-free in the MSL encoder
History

Thu, 12 Mar 2026 15:15:00 +0000

Type Values Removed Values Added
CPEs cpe:2.3:a:imagemagick:imagemagick:*:*:*:*:*:*:*:*

Wed, 11 Mar 2026 12:15:00 +0000

Type Values Removed Values Added
References
Metrics threat_severity

None

 threat_severity

Moderate

Tue, 10 Mar 2026 17:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 10 Mar 2026 14:15:00 +0000

Type Values Removed Values Added
First Time appeared Imagemagick
Imagemagick imagemagick
Vendors & Products Imagemagick
Imagemagick imagemagick

Mon, 09 Mar 2026 22:00:00 +0000

Type Values Removed Values Added
Description ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-16 and 6.9.13-41, a heap-use-after-free vulnerability exists in the MSL encoder, where a cloned image is destroyed twice. The MSL coder does not support writing MSL so the write capability has been removed. This vulnerability is fixed in 7.1.2-16 and 6.9.13-41.
Title ImageMagick has a heap use-after-free in the MSL encoder
Weaknesses CWE-416
References
Metrics cvssV3_1

{'score': 4, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L'}

Subscriptions

Imagemagick Imagemagick
cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-03-10T16:02:20.994Z

Reserved: 2026-03-02T21:43:19.927Z

Link: CVE-2026-28688

cve-icon Vulnrichment

Updated: 2026-03-10T16:02:18.407Z

cve-icon NVD

Status : Analyzed

Published: 2026-03-10T07:43:43.813

Modified: 2026-03-12T15:08:20.260

Link: CVE-2026-28688

cve-icon Redhat

Severity : Moderate

Publid Date: 2026-03-09T21:38:08Z

Links: CVE-2026-28688 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-04-18T09:45:25Z

Weaknesses