CVE-2026-28493: ImageMagick Buffer Overflow Vulnerability

CVE-2026-28493 Overview

CVE-2026-28493 is an integer overflow vulnerability in the SIXEL decoder of ImageMagick, the widely used open-source image processing suite. Attackers can trigger an out-of-bounds memory access by supplying a specially crafted SIXEL image. The flaw affects all ImageMagick versions prior to 7.1.2-16 and is tracked under CWE-190: Integer Overflow or Wraparound. The maintainers fixed the issue in release 7.1.2-16. The vulnerability is exposed wherever ImageMagick processes untrusted image input, including web applications, image conversion pipelines, and document processors that rely on the library.

Critical Impact
A remote attacker can crash ImageMagick processes or trigger out-of-bounds memory access by uploading a malicious SIXEL file, leading to denial of service and potential integrity impact.

Affected Products

ImageMagick versions prior to 7.1.2-16
Applications embedding the vulnerable ImageMagick SIXEL decoder
Image processing pipelines that accept SIXEL-format input

Discovery Timeline

2026-03-10 - CVE-2026-28493 published to NVD
2026-03-12 - Last updated in NVD database

Technical Details for CVE-2026-28493

Vulnerability Analysis

The vulnerability resides in the SIXEL decoder routine inside ImageMagick. SIXEL is a bitmap graphics format originally developed by DEC for terminal output. During decoding, the parser computes buffer dimensions and offsets from attacker-controlled header fields. An integer overflow in these calculations produces a smaller-than-expected allocation or an out-of-bounds index. Subsequent memory writes or reads then operate outside the bounds of the intended buffer.

The issue is classified as [CWE-190]. The CVSS vector indicates a network attack vector with no privileges or user interaction required, though attack complexity is rated high because the malformed image must reach a vulnerable decoder path. Impact is concentrated on availability, with limited integrity impact and no confidentiality exposure.

Root Cause

The decoder performs arithmetic on width, height, or color register values without sufficient bounds checking. When the product of these values exceeds the range of the underlying integer type, the result wraps around. The decoder then trusts the truncated value when allocating or indexing the pixel buffer. This pattern is common to many image decoder vulnerabilities and is addressed in commit-level fixes shipped in release 7.1.2-16.

Attack Vector

An attacker delivers a crafted SIXEL image to any application that invokes the ImageMagick decoder. Common delivery paths include avatar uploads, document conversion services, thumbnail generators, and command-line tools such as convert or magick. No authentication is required when the target service exposes image processing to anonymous users. Successful exploitation results in process crash, memory corruption, or unexpected output. Refer to the GitHub Security Advisory GHSA-r39q-jr8h-gcq2 for the authoritative technical description.

Detection Methods for CVE-2026-28493

Indicators of Compromise

Repeated crashes or segmentation faults in convert, magick, or MagickCore worker processes.
Unusually small SIXEL files with oversized declared dimensions in image upload logs.
Core dumps referencing ReadSIXELImage or related decoder symbols.

Detection Strategies

Inventory ImageMagick installations and flag any version below 7.1.2-16 using software composition analysis tooling.
Monitor application logs for decoder errors, abnormal exit codes, and signal-terminated worker processes.
Inspect uploaded files for the SIXEL magic sequence \\x1bP followed by parameters and validate declared dimensions before passing to ImageMagick.

Monitoring Recommendations

Alert on ImageMagick processes that exceed expected memory or CPU thresholds during image decoding.
Capture and review process telemetry from image processing services for crash patterns correlated with SIXEL inputs.
Forward host and container runtime events to a centralized data lake for retrospective hunting against this CVE.

How to Mitigate CVE-2026-28493

Immediate Actions Required

Upgrade ImageMagick to version 7.1.2-16 or later across all servers, containers, and developer workstations.
Restrict accepted image formats in upload endpoints and remove SIXEL from allowlists where it is not required.
Run ImageMagick in a sandboxed, low-privilege context with resource limits to contain any decoder crash.

Patch Information

The ImageMagick maintainers fixed the integer overflow in the SIXEL decoder in release 7.1.2-16. See the ImageMagick GitHub Security Advisory GHSA-r39q-jr8h-gcq2 for advisory details and the corresponding fix commits. Linux distributions ship backported patches through their package repositories, so apply vendor updates where direct upgrade is not possible.

Workarounds

Disable the SIXEL coder in policy.xml by adding a policy entry that denies the SIXEL and SIX modules.
Reject SIXEL files at the application layer by validating MIME type and magic bytes before invoking ImageMagick.
Enforce strict resource limits in policy.xml for memory, map, width, and height to limit damage from decoder bugs.

bash

# Configuration example: disable the SIXEL coder in /etc/ImageMagick-7/policy.xml
<policymap>
  <policy domain="coder" rights="none" pattern="SIXEL" />
  <policy domain="coder" rights="none" pattern="SIX" />
  <policy domain="resource" name="width" value="16KP" />
  <policy domain="resource" name="height" value="16KP" />
  <policy domain="resource" name="memory" value="256MiB" />
</policymap>