Stack Buffer Overflow in ImageMagick Due to MNG Encoder Flaw
CVE-2026-28690

6.9MEDIUM

Key Information:

Vendor

Imagemagick
Status
Imagemagick
Vendor
CVE Published:
9 March 2026

What is CVE-2026-28690?

A stack buffer overflow vulnerability exists in the MNG image format encoder of ImageMagick prior to version 7.1.2-16 and 6.9.13-41. This flaw arises due to a lack of proper bounds checking, allowing attackers to send specially crafted images that might lead to stack corruption. This vulnerability could potentially be exploited to execute arbitrary code or crash the application, posing serious security risks to affected systems. Users are urged to upgrade to the latest versions to mitigate potential threats.

Affected Version(s)

ImageMagick >= 7.0.0, < 7.1.2-16 < 7.0.0, 7.1.2-16

ImageMagick < 6.9.13-41 < 6.9.13-41

References

https://github.com/ImageMagick/ImageMagick/security/advis...
x_refsource_CONFIRM

CVSS V3.1

Score:
6.9
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
High
Availability:
Low
Attack Vector:
Local
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.