CVE-2026-28687: 
C# vulnerability analysis and mitigation

CVE-2026-28687 is a heap use-after-free vulnerability in ImageMagick's MSL (Magick Scripting Language) decoder that allows a remote attacker to trigger access to freed memory by supplying a crafted MSL file, resulting in a denial of service. It affects ImageMagick versions prior to 6.9.13-41 (6.x branch) and versions 7.0.0-0 through 7.1.2-15 (7.x branch), as well as Magick.NET NuGet packages prior to 14.10.4. The vulnerability was published on March 9, 2026, with patches released the same day. It carries a CVSS v3.1 base score of 5.3 (Medium) (GitHub Advisory, Red Hat).

The root cause is a heap use-after-free (CWE-416 / CWE-825) in ImageMagick's MSL decoder, where memory is accessed after it has been freed during the parsing of MSL files. An attacker can exploit this by crafting a malicious MSL file that triggers the decoder to dereference a freed heap pointer, as confirmed by AddressSanitizer output showing a READ of size 8 at a freed address (0x527000011550). The attack vector is network-based, requires no privileges and no user interaction, and the only precondition is that the target application processes attacker-supplied MSL files. The vulnerability was reported by researcher ylwango613 (GitHub Advisory, Red Hat Bugzilla).

Successful exploitation causes a denial of service condition by crashing or destabilizing the ImageMagick process through access to freed heap memory. There is no known confidentiality or integrity impact — the CVSS assessment assigns no confidentiality or integrity loss, only low availability impact. Applications that accept and process user-supplied MSL files (e.g., web services using ImageMagick for image conversion) are the primary at-risk assets; lateral movement or data exfiltration are not associated with this vulnerability (GitHub Advisory, Red Hat).

No public proof-of-concept exploit code is known to exist, and there is no evidence of in-the-wild exploitation at this time. The EPSS score is approximately 0.039–0.061%, placing it in the 19th percentile for exploitation likelihood within 30 days. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported (Github Advisory, Feedly).

Upgrade ImageMagick to version 6.9.13-41 or later (6.x branch) or 7.1.2-16 or later (7.x branch). For .NET users, upgrade Magick.NET NuGet packages to version 14.10.4 or later. As a workaround where patching is not immediately possible, restrict or disable processing of MSL files from untrusted external sources, and consider sandboxing image processing operations. Debian, SUSE/openSUSE, and Amazon Linux 2 have also issued distribution-level security updates addressing this CVE (GitHub Advisory, Red Hat Bugzilla).

The vulnerability received routine coverage from Linux distribution security channels including Debian, SUSE/openSUSE, and Amazon Linux, which issued advisories and updated packages. Detection plugins were published by Tenable (Nessus) and Qualys shortly after disclosure. No notable researcher commentary or significant social media discussion beyond automated CVE tracking posts has been observed (Feedly).