Raw vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HCVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.
Summary
CVE-2026-28691 is a high-severity Unchecked Return Value (CWE-252) vulnerability in Imagemagick Imagemagick. Its CVSS base score is 7.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 28th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to SA-11 (Developer Testing and Evaluation) and SA-15 (Development Process, Standards, and Tools) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2026-28691 is an uninitialized pointer dereference vulnerability in the JBIG decoder of ImageMagick, stemming from a missing check. ImageMagick is free and open-source software for editing and manipulating digital images. The issue affects versions prior to 7.1.2-16 and 6.9.13-41 and is associated with CWE-252 (Unchecked Return Value) and CWE-824 (Access of Uninitialized Pointer).
With a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), the vulnerability can be exploited remotely by unauthenticated attackers with low complexity and no user interaction required. Attackers can supply a specially crafted JBIG image to affected ImageMagick instances, triggering the uninitialized pointer dereference and causing high-impact denial of service, such as application crashes.
The vulnerability is addressed in ImageMagick versions 7.1.2-16 and 6.9.13-41. Additional details on the issue and remediation are available in the GitHub security advisory at https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-wj8w-pjxf-9g4f.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-10385
Vulnerability Data
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-16 and 6.9.13-41, an uninitialized pointer dereference vulnerability exists in the JBIG decoder due to a missing check. This vulnerability is fixed in 7.1.2-16…
more
and 6.9.13-41.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Developer testing and code evaluation can discover instances where return values are ignored.
Requiring a documented development process and coding standards can mandate explicit checking of all function return values.
Security engineering principles can mandate memory-safety practices and language choices that structurally avoid uninitialized pointer use.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices directly require checking and handling all function return values to detect error conditions.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Security testing in development and acceptance can detect missing return-value checks.
Secure development life cycle mandates verification of return values to prevent undetected failures.
Application security requirements include input/output validation and error handling that covers return-value checks.
Secure system architecture and engineering principles require robust error handling and defensive coding practices.
Secure coding explicitly requires checking return values to avoid CWE-252.