medium5.3
CVE-2026-28687
ImageMagick has Heap Use-After-Free in ImageMagick MSL decoder
Impact
A heap use-after-free vulnerability in ImageMagick's MSL decoder allows an attacker to trigger access to freed memory by crafting an MSL file. ``` ================================================================= ==1500633==ERROR: AddressSanitizer: heap-use-after-free on address 0x527000011550 at pc 0x5612583fa212 bp 0x7ffedb86d160 sp 0x7ffedb86d150 READ of size 8 at 0x527000011550 thread T0 ```
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| nuget | Magick.NET-Q16-AnyCPU | < 14.10.4 | 14.10.4 |
| nuget | Magick.NET-Q16-HDRI-AnyCPU | < 14.10.4 | 14.10.4 |
| nuget | Magick.NET-Q16-HDRI-OpenMP-arm64 | < 14.10.4 | 14.10.4 |
| nuget | Magick.NET-Q16-HDRI-arm64 | < 14.10.4 | 14.10.4 |
| nuget | Magick.NET-Q16-HDRI-x64 | < 14.10.4 | 14.10.4 |
| nuget | Magick.NET-Q16-HDRI-x86 | < 14.10.4 | 14.10.4 |
| nuget | Magick.NET-Q16-OpenMP-arm64 | < 14.10.4 | 14.10.4 |
| nuget | Magick.NET-Q16-OpenMP-x64 | < 14.10.4 | 14.10.4 |
| nuget | Magick.NET-Q16-OpenMP-x86 | < 14.10.4 | 14.10.4 |
| nuget | Magick.NET-Q16-arm64 | < 14.10.4 | 14.10.4 |
| nuget | Magick.NET-Q16-x64 | < 14.10.4 | 14.10.4 |
| nuget | Magick.NET-Q16-x86 | < 14.10.4 | 14.10.4 |
| nuget | Magick.NET-Q16-HDRI-OpenMP-x64 | < 14.10.4 | 14.10.4 |
| nuget | Magick.NET-Q8-AnyCPU | < 14.10.4 | 14.10.4 |
| nuget | Magick.NET-Q8-OpenMP-arm64 | < 14.10.4 | 14.10.4 |
| nuget | Magick.NET-Q8-OpenMP-x64 | < 14.10.4 | 14.10.4 |
| nuget | Magick.NET-Q8-arm64 | < 14.10.4 | 14.10.4 |
| nuget | Magick.NET-Q8-x64 | < 14.10.4 | 14.10.4 |
| nuget | Magick.NET-Q8-x86 | < 14.10.4 | 14.10.4 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Imagemagick | Imagemagick | before 6.9.13-41 from 7.0.0-0 before 7.1.2-16 |