CVE-2026-28687: ImageMagick has Heap Use-After-Free in ImageMagick MSL decoder

March 12, 2026

A heap use-after-free vulnerability in ImageMagick’s MSL decoder allows an attacker to trigger access to freed memory by crafting an MSL file.

=================================================================
==1500633==ERROR: AddressSanitizer: heap-use-after-free on address 0x527000011550 at pc 0x5612583fa212 bp 0x7ffedb86d160 sp 0x7ffedb86d150
READ of size 8 at 0x527000011550 thread T0

References

github.com/ImageMagick/ImageMagick
github.com/ImageMagick/ImageMagick/security/advisories/GHSA-fpvf-frm6-625q
github.com/advisories/GHSA-fpvf-frm6-625q
github.com/dlemstra/Magick.NET/releases/tag/14.10.4
nvd.nist.gov/vuln/detail/CVE-2026-28687

Code Behaviors & Features

Detect and mitigate CVE-2026-28687 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →