CVE-2026-28691: ImageMagick Use-After-Free Vulnerability

CVE-2026-28691 Overview

An uninitialized pointer dereference vulnerability has been discovered in ImageMagick, the widely-used open-source image processing suite. The flaw exists in the JBIG decoder component due to a missing validation check, allowing remote attackers to cause a denial of service condition by crafting malicious JBIG image files.

Critical Impact

Remote attackers can exploit this vulnerability to crash ImageMagick processes, causing denial of service in applications that rely on ImageMagick for image processing operations.

Affected Products

• ImageMagick versions prior to 7.1.2-16
• ImageMagick versions prior to 6.9.13-41
• Applications and services using vulnerable ImageMagick libraries for JBIG image processing

Discovery Timeline

• 2026-03-10 - CVE-2026-28691 published to NVD
• 2026-03-11 - Last updated in NVD database

Technical Details for CVE-2026-28691

Vulnerability Analysis

This vulnerability stems from improper handling of pointer initialization in the JBIG decoder component of ImageMagick. When processing specially crafted JBIG image files, the decoder fails to perform necessary validation checks before dereferencing a pointer, leading to access of uninitialized memory. The flaw is classified under CWE-252 (Unchecked Return Value), indicating that the underlying issue relates to missing validation of critical state before pointer operations.

The vulnerability is exploitable over the network without requiring authentication or user interaction, making it particularly dangerous for web applications and services that process user-uploaded images. Successful exploitation results in a denial of service condition, causing the ImageMagick process to crash and potentially disrupting dependent services.

Root Cause

The root cause of CVE-2026-28691 is a missing check in the JBIG decoder that fails to verify pointer initialization before dereferencing. This coding oversight allows an attacker to trigger access to uninitialized memory by providing malformed JBIG image data that bypasses normal initialization routines.

Attack Vector

The attack vector for this vulnerability is network-based. An attacker can exploit this flaw by:

1. Crafting a malicious JBIG image file with specific malformed data
2. Submitting the crafted image to any application or service that uses ImageMagick for processing
3. Triggering the uninitialized pointer dereference when ImageMagick attempts to decode the JBIG data

Common attack scenarios include uploading malicious images to web applications, sending crafted images via email processing systems, or targeting document conversion services that utilize ImageMagick.

The vulnerability affects the availability of the system as it causes process crashes. Technical details and the specific code path involved can be found in the GitHub Security Advisory.

Detection Methods for CVE-2026-28691

Indicators of Compromise

• Unexpected ImageMagick process crashes when processing JBIG format images
• Segmentation fault errors in application logs related to ImageMagick operations
• Repeated service restarts or unavailability in image processing pipelines
• Core dump files generated during JBIG image processing operations

Detection Strategies

• Monitor ImageMagick processes for abnormal termination signals and crash patterns
• Implement file type validation to identify and quarantine suspicious JBIG files before processing
• Deploy runtime application self-protection (RASP) solutions to detect memory access violations
• Review system logs for segmentation faults or null pointer dereference errors in ImageMagick binaries

Monitoring Recommendations

• Enable detailed logging for ImageMagick operations, particularly for JBIG decoder activities
• Configure process monitoring to alert on unexpected ImageMagick terminations
• Implement anomaly detection for unusual patterns in image upload volumes or types
• Use SentinelOne's behavioral AI to detect exploitation attempts targeting ImageMagick processes

How to Mitigate CVE-2026-28691

Immediate Actions Required

• Upgrade ImageMagick to version 7.1.2-16 or later for the 7.x branch
• Upgrade ImageMagick to version 6.9.13-41 or later for the 6.x branch
• Audit all systems and applications that incorporate ImageMagick for image processing
• Consider disabling JBIG decoding support if not required for your use case

Patch Information

ImageMagick has released patched versions that address this vulnerability. Users should upgrade to the following versions:

• ImageMagick 7.x series: Upgrade to version 7.1.2-16 or later
• ImageMagick 6.x series: Upgrade to version 6.9.13-41 or later

Patch details and release notes are available in the GitHub Security Advisory.

Workarounds

• Disable JBIG coder support in ImageMagick policy configuration until patches can be applied
• Implement input validation to block or quarantine JBIG format files before processing
• Run ImageMagick processes in isolated containers or sandboxed environments to limit crash impact
• Configure resource limits and automatic restart policies for ImageMagick-dependent services

# ImageMagick policy.xml configuration to disable JBIG decoder
# Location: /etc/ImageMagick-7/policy.xml or /etc/ImageMagick-6/policy.xml

# Add this policy rule to disable JBIG format processing
# <policy domain="coder" rights="none" pattern="JBIG" />

# Verify ImageMagick version after patching
magick --version
# or for ImageMagick 6.x
convert --version