Cyber Posture

CVE-2026-28691

High

Published: 10 March 2026

Published
10 March 2026
Modified
11 March 2026
KEV Added
Patch
CVSS Score 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS Score 0.0006 18.7th percentile
Risk Priority 15 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2026-28691 is a high-severity Unchecked Return Value (CWE-252) vulnerability in Imagemagick Imagemagick. Its CVSS base score is 7.5 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Application or System Exploitation (T1499.004); ranked at the 18.7th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

Threat & Defense at a Glance

What attackers do: exploitation maps to Application or System Exploitation (T1499.004).
Threat & Defense Details

MITRE ATT&CK Enterprise TechniquesAI

T1499.004 Application or System Exploitation Impact
Adversaries may exploit software vulnerabilities that can cause an application or system to crash and deny availability to users.
Why these techniques?

Uninitialized pointer dereference triggered by crafted JBIG input directly enables remote application crash/DoS with no auth or interaction, mapping to T1499.004 (Application or System Exploitation).

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

NVD Description

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-16 and 6.9.13-41, an uninitialized pointer dereference vulnerability exists in the JBIG decoder due to a missing check. This vulnerability is fixed in 7.1.2-16…

more

and 6.9.13-41.

Deeper analysisAI

CVE-2026-28691 is an uninitialized pointer dereference vulnerability in the JBIG decoder of ImageMagick, stemming from a missing check. ImageMagick is free and open-source software for editing and manipulating digital images. The issue affects versions prior to 7.1.2-16 and 6.9.13-41 and is associated with CWE-252 (Unchecked Return Value) and CWE-824 (Access of Uninitialized Pointer).

With a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), the vulnerability can be exploited remotely by unauthenticated attackers with low complexity and no user interaction required. Attackers can supply a specially crafted JBIG image to affected ImageMagick instances, triggering the uninitialized pointer dereference and causing high-impact denial of service, such as application crashes.

The vulnerability is addressed in ImageMagick versions 7.1.2-16 and 6.9.13-41. Additional details on the issue and remediation are available in the GitHub security advisory at https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-wj8w-pjxf-9g4f.

Details

CWE(s)

Affected Products

imagemagick
imagemagick
≤ 6.9.13-41 · 7.0.0-0 — 7.1.2-16

CVEs Like This One

CVE-2026-33908Same product: Imagemagick Imagemagick
CVE-2026-25799Same product: Imagemagick Imagemagick
CVE-2026-25989Same product: Imagemagick Imagemagick
CVE-2026-25795Same product: Imagemagick Imagemagick
CVE-2026-26283Same product: Imagemagick Imagemagick
CVE-2026-22770Same product: Imagemagick Imagemagick
CVE-2026-30883Same product: Imagemagick Imagemagick
CVE-2026-25971Same product: Imagemagick Imagemagick
CVE-2026-30931Same product: Imagemagick Imagemagick
CVE-2026-26066Same product: Imagemagick Imagemagick

References