CVE-2026-28692: ImageMagick has a heap buffer over-read via 32-bit integer overflow in MAT decoder

March 10, 2026

In MAT decoder uses 32-bit arithmetic due to incorrect parenthesization resulting in a heap over-read.

=================================================================
==969652==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x506000003b40 at pc 0x555557b2a926 bp 0x7fffffff4c80 sp 0x7fffffff4c70
READ of size 8 at 0x506000003b40 thread T0

References

github.com/ImageMagick/ImageMagick
github.com/ImageMagick/ImageMagick/security/advisories/GHSA-mrmj-x24c-wwcv
github.com/advisories/GHSA-mrmj-x24c-wwcv
github.com/dlemstra/Magick.NET/releases/tag/14.10.4
nvd.nist.gov/vuln/detail/CVE-2026-28692

Code Behaviors & Features

Detect and mitigate CVE-2026-28692 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →