CVE-2026-28691: 
C# vulnerability analysis and mitigation

CVE-2026-28691 is an uninitialized pointer dereference vulnerability in the JBIG decoder of ImageMagick, a widely used open-source image editing library. The flaw exists due to a missing check in the JBIG decoding logic and can be triggered remotely without authentication or user interaction, resulting in a denial of service. It affects all ImageMagick versions prior to 7.1.2-16 (7.x branch) and prior to 6.9.13-41 (6.x branch), as well as Magick.NET NuGet packages prior to version 14.10.4. The vulnerability was published on March 9, 2026, with a CVSS v3.1 base score of 7.5 (High) (GitHub Advisory, Red Hat Bugzilla).

The root cause is classified under CWE-824 (Access of Uninitialized Pointer) and CWE-252 (Unchecked Return Value): the JBIG decoder fails to validate a return value, leaving a pointer uninitialized before it is subsequently accessed. An attacker can exploit this by supplying a specially crafted JBIG image file to any system or service that processes images through ImageMagick. No privileges or user interaction are required, and the attack vector is network-accessible, making it exploitable in any context where ImageMagick processes remotely supplied image data (e.g., web upload handlers, image conversion APIs). The vulnerability was reported by researcher zerojackyi (GitHub Advisory, Github Advisory DB).

Successful exploitation causes a denial of service by crashing the ImageMagick process when it attempts to dereference the uninitialized pointer while decoding a malicious JBIG image. The impact is limited to availability — there is no evidence of confidentiality or integrity compromise based on the current CVSS assessment (C:N/I:N/A:H). In environments where ImageMagick is used as part of a shared service or pipeline, repeated exploitation could render image processing functionality unavailable, potentially disrupting dependent applications (GitHub Advisory, Red Hat Bugzilla).

1. Identify target: Locate a network-accessible service or application that uses a vulnerable version of ImageMagick (< 7.1.2-16 or < 6.9.13-41) to process user-supplied image files, such as a web application with image upload functionality.
2. Craft malicious JBIG image: Create a specially crafted JBIG (Joint Bi-level Image Experts Group) image file designed to trigger the missing check in the JBIG decoder, causing a pointer to remain uninitialized.
3. Submit the file: Upload or submit the malicious JBIG image to the target service (e.g., via an HTTP file upload endpoint, email attachment processor, or API call that invokes ImageMagick for conversion or thumbnail generation).
4. Trigger crash: When ImageMagick processes the file, the JBIG decoder accesses the uninitialized pointer, causing a segmentation fault or application crash, resulting in denial of service for the image processing component (GitHub Advisory).

• Logs: Repeated application or system logs showing ImageMagick process crashes (segmentation faults, signal 11/SIGSEGV) when processing JBIG image files; error messages referencing the JBIG decoder component.
• File System: Presence of unexpected or anomalous .jbig, .jbg, or .bie image files in upload directories or temporary processing folders.
• Process: Abnormal termination of ImageMagick worker processes (convert, magick) with core dumps generated in the working directory.
• Network: Unusual or repeated submissions of JBIG-format image files from a single source IP to image processing endpoints.

Upgrade ImageMagick to version 7.1.2-16 or later (7.x branch) or 6.9.13-41 or later (6.x branch). For Magick.NET users, upgrade to version 14.10.4 or later. Red Hat has addressed this issue via RHSA-2026:6713 for Red Hat Enterprise Linux 7 Extended Lifecycle Support. As interim workarounds, restrict network access to systems running vulnerable ImageMagick versions, avoid processing JBIG image files from untrusted sources, and consider implementing input validation or file-type filtering to reject JBIG files if not operationally required (GitHub Advisory, Red Hat Bugzilla).

The vulnerability received standard coverage across Linux distribution security channels, with Debian, SUSE/openSUSE, Oracle Linux, and Amazon Linux all issuing security advisories and updated packages. Red Hat addressed it via an errata for RHEL 7 ELS. Detection plugins were published by Tenable (Nessus) and Qualys shortly after disclosure. Community discussion was limited, with no notable researcher commentary or significant social media activity beyond routine vulnerability tracking (Red Hat Bugzilla).