CVE-2026-28688: 
C# vulnerability analysis and mitigation

CVE-2026-28688 is a heap-use-after-free vulnerability in the MSL (Magick Scripting Language) encoder of ImageMagick, where a cloned image object is destroyed twice, leading to memory corruption. It affects ImageMagick versions prior to 7.1.2-16 and 6.9.13-41, as well as Magick.NET NuGet packages prior to version 14.10.4. The vulnerability was published on March 9, 2026, by researcher ylwango613, and fixed versions were released the same day. The CVSS v3.1 base score is 4.0 (Moderate) per the GitHub Security Advisory, though NVD assigned a score of 5.3 (Medium) using a network attack vector (GitHub Advisory, ImageMagick Advisory).

The root cause is a Use After Free condition (CWE-416) in the MSL encoder within MagickCore/image.c at line 1195 in the DestroyImage function. When the MSL coder processes an image, it clones the image object and subsequently destroys it twice, resulting in a heap-use-after-free detected by AddressSanitizer. Because the MSL coder does not actually support writing MSL output, the fix was to remove the write capability entirely from the MSL coder, eliminating the double-free code path. The vulnerability requires local access or the ability to supply a crafted image file to a vulnerable ImageMagick instance (ImageMagick Advisory, GitHub Advisory).

Successful exploitation of this vulnerability results in a low availability impact — specifically, it can cause a crash or abnormal termination of the ImageMagick process due to heap memory corruption. There is no confidentiality or integrity impact, as the vulnerability does not expose sensitive data or allow unauthorized data modification. The scope is limited to the affected component, and there is no known potential for lateral movement or privilege escalation from this vulnerability alone (GitHub Advisory, ImageMagick Advisory).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported for CVE-2026-28688. The EPSS score is approximately 0.047% (15th percentile), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been identified (GitHub Advisory).

Users should upgrade ImageMagick to version 7.1.2-16 or later (for the 7.x branch) or 6.9.13-41 or later (for the 6.x branch). Magick.NET NuGet package users should upgrade to version 14.10.4 or later. No configuration-based workaround is documented; upgrading to a patched version is the recommended and only known remediation. Downstream distributions including Debian and SUSE have also released updated packages (ImageMagick Advisory, GitHub Advisory).