CVE-2026-28494: ImageMagick vulnerable to stack corruption through long morphology kernel names or arrays

March 12, 2026

A stack buffer overflow exists in ImageMagick’s morphology kernel parsing functions. User-controlled kernel strings exceeding a buffer are copied into fixed-size stack buffers via memcpy without bounds checking, resulting in stack corruption.

References

github.com/ImageMagick/ImageMagick
github.com/ImageMagick/ImageMagick/security/advisories/GHSA-932h-jw47-73jm
github.com/advisories/GHSA-932h-jw47-73jm
github.com/dlemstra/Magick.NET/releases/tag/14.10.4
nvd.nist.gov/vuln/detail/CVE-2026-28494

Code Behaviors & Features

Detect and mitigate CVE-2026-28494 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →