Cloudanix VulnDB

CVE-2026-28494

High · 7.1

CVSS

7.1

EPSS

0.2%

Published

Mar 10, 2026

CISA due date

—

The record

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-16 and 6.9.13-41, a stack buffer overflow exists in ImageMagick's morphology kernel parsing functions. User-controlled kernel strings exceeding a buffer are copied into fixed-size stack buffers via memcpy without bounds checking, resulting in stack corruption. This vulnerability is fixed in 7.1.2-16 and 6.9.13-41.

Affected packages

Ecosystem Package Introduced Fixed
SUSE:Linux Enterprise Server 15 SP6-LTSS ImageMagick 0 7.1.1.21-150600.3.50.1
SUSE:Linux Enterprise Server for SAP Applications 15 SP6 ImageMagick 0 7.1.1.21-150600.3.50.1
openSUSE:Leap 15.6 ImageMagick 0 7.1.1.21-150600.3.50.1
openSUSE:Leap 16.0 ImageMagick 0 7.1.2.0-160000.7.1
openSUSE:Tumbleweed ImageMagick 0 7.1.2.17-1.1

Related vulnerabilities