CVE-2026-28687: ImageMagick Use-After-Free Vulnerability

CVE-2026-28687 Overview

ImageMagick is a widely-used, free, and open-source software suite for editing and manipulating digital images. A heap use-after-free vulnerability has been identified in ImageMagick's MSL (Magick Scripting Language) decoder that allows an attacker to trigger access to freed memory by crafting a malicious MSL file. This vulnerability affects versions prior to 7.1.2-16 and 6.9.13-41.

Critical Impact

Attackers can exploit this use-after-free vulnerability to cause denial of service conditions by crafting malicious MSL files that trigger access to freed heap memory during image processing operations.

Affected Products

• ImageMagick versions prior to 7.1.2-16
• ImageMagick versions prior to 6.9.13-41
• Systems processing untrusted MSL files with vulnerable ImageMagick installations

Discovery Timeline

• 2026-03-10 - CVE-2026-28687 published to NVD
• 2026-03-12 - Last updated in NVD database

Technical Details for CVE-2026-28687

Vulnerability Analysis

This vulnerability is classified as CWE-416 (Use After Free), a memory corruption flaw that occurs when a program continues to use a pointer after the memory it references has been freed. In the context of ImageMagick's MSL decoder, this manifests when processing specially crafted MSL files causes the application to reference heap memory that has already been deallocated.

The MSL decoder is responsible for parsing and executing Magick Scripting Language files, which provide a scripting interface for ImageMagick operations. The use-after-free condition can be triggered through network-accessible attack vectors, requiring no authentication or user interaction. While the vulnerability primarily impacts availability, the memory safety issue could potentially be leveraged for more severe exploitation in certain configurations.

Root Cause

The root cause lies in improper memory management within ImageMagick's MSL decoder. When processing certain MSL file structures, the decoder fails to properly track the lifecycle of heap-allocated objects. This results in a scenario where memory is freed but pointers to that memory remain in use, creating a dangling pointer condition that leads to use-after-free access when those pointers are subsequently dereferenced.

Attack Vector

The vulnerability is exploitable via network-based attack vectors. An attacker can craft a malicious MSL file designed to trigger the use-after-free condition when processed by ImageMagick. Attack scenarios include:

• Uploading malicious MSL files to web applications that process images using ImageMagick
• Serving malicious MSL content through compromised or attacker-controlled image hosting services
• Including malicious MSL files in document attachments that may be automatically processed

The attack requires no privileges and no user interaction beyond the target system processing the malicious file. Due to the nature of heap use-after-free vulnerabilities, exploitation can lead to crashes, denial of service, or in some cases, arbitrary code execution if an attacker can control the contents of the freed memory region.

Detection Methods for CVE-2026-28687

Indicators of Compromise

• Unexpected crashes or segmentation faults in ImageMagick processes during MSL file processing
• Abnormal memory access patterns or error logs indicating use-after-free conditions
• Presence of suspicious or malformed MSL files in upload directories or processing queues
• Increased resource consumption or service instability in image processing pipelines

Detection Strategies

• Monitor ImageMagick process crashes and analyze core dumps for use-after-free signatures
• Implement file type validation to detect and quarantine suspicious MSL files before processing
• Deploy memory sanitizer tools (AddressSanitizer, Valgrind) in testing environments to identify exploitation attempts
• Enable verbose logging for ImageMagick operations to capture processing anomalies

Monitoring Recommendations

• Configure real-time monitoring for ImageMagick process health and crash events
• Implement alerting for unusual MSL file uploads or processing requests
• Review system logs for memory-related errors in applications using ImageMagick libraries
• Track version information across ImageMagick deployments to ensure patch compliance

How to Mitigate CVE-2026-28687

Immediate Actions Required

• Upgrade ImageMagick to version 7.1.2-16 or later for the 7.x branch
• Upgrade ImageMagick to version 6.9.13-41 or later for the 6.x branch
• Review and restrict MSL file processing capabilities in production environments
• Implement input validation to filter potentially malicious MSL content

Patch Information

The vulnerability has been fixed in ImageMagick versions 7.1.2-16 and 6.9.13-41. Organizations should prioritize upgrading to these patched versions. For detailed information about the fix, refer to the ImageMagick Security Advisory.

Workarounds

• Disable MSL coder in ImageMagick's policy.xml configuration file if MSL processing is not required
• Implement strict file type allowlists to prevent processing of MSL files from untrusted sources
• Run ImageMagick processes in sandboxed or containerized environments to limit impact of exploitation
• Apply resource limits to ImageMagick processes to mitigate potential denial of service impact

# Disable MSL coder in ImageMagick policy.xml
# Add the following to /etc/ImageMagick-6/policy.xml or /etc/ImageMagick-7/policy.xml
<policy domain="coder" rights="none" pattern="MSL" />

# Verify the policy is active
identify -list policy | grep -i msl