CVE-2026-28493

MEDIUM

ImageMagick has Integer Overflow leading to out of bounds write in SIXEL decoder

Published March 12, 2026Updated March 20, 2026Source: osv

Summary

An integer overflow vulnerability exists in the SIXEL decoer. The vulnerability allows an attacker to perform an out of bounds via a specially crafted mage.

Remediation

Upgrade to the fixed version using your package manager.

NuGet

Update Magick.NET-Q16-x64 to 14.10.4 or later

dotnet add package Magick.NET-Q16-x64 --version 14.10.4

NuGet

Update Magick.NET-Q16-OpenMP-x86 to 14.10.4 or later

dotnet add package Magick.NET-Q16-OpenMP-x86 --version 14.10.4

NuGet

Update Magick.NET-Q8-arm64 to 14.10.4 or later

dotnet add package Magick.NET-Q8-arm64 --version 14.10.4

NuGet

Update Magick.NET-Q16-HDRI-OpenMP-arm64 to 14.10.4 or later

dotnet add package Magick.NET-Q16-HDRI-OpenMP-arm64 --version 14.10.4

NuGet

Update Magick.NET-Q16-HDRI-AnyCPU to 14.10.4 or later

dotnet add package Magick.NET-Q16-HDRI-AnyCPU --version 14.10.4

NuGet

Update Magick.NET-Q8-OpenMP-arm64 to 14.10.4 or later

dotnet add package Magick.NET-Q8-OpenMP-arm64 --version 14.10.4

NuGet

Update Magick.NET-Q16-arm64 to 14.10.4 or later

dotnet add package Magick.NET-Q16-arm64 --version 14.10.4

NuGet

Update Magick.NET-Q8-x64 to 14.10.4 or later

dotnet add package Magick.NET-Q8-x64 --version 14.10.4

NuGet

Update Magick.NET-Q16-HDRI-arm64 to 14.10.4 or later

dotnet add package Magick.NET-Q16-HDRI-arm64 --version 14.10.4

NuGet

Update Magick.NET-Q16-HDRI-x86 to 14.10.4 or later

dotnet add package Magick.NET-Q16-HDRI-x86 --version 14.10.4

NuGet

Update Magick.NET-Q16-OpenMP-x64 to 14.10.4 or later

dotnet add package Magick.NET-Q16-OpenMP-x64 --version 14.10.4

NuGet

Update Magick.NET-Q8-AnyCPU to 14.10.4 or later

dotnet add package Magick.NET-Q8-AnyCPU --version 14.10.4

NuGet

Update Magick.NET-Q8-x86 to 14.10.4 or later

dotnet add package Magick.NET-Q8-x86 --version 14.10.4

NuGet

Update Magick.NET-Q16-OpenMP-arm64 to 14.10.4 or later

dotnet add package Magick.NET-Q16-OpenMP-arm64 --version 14.10.4

NuGet

Update Magick.NET-Q16-HDRI-x64 to 14.10.4 or later

dotnet add package Magick.NET-Q16-HDRI-x64 --version 14.10.4

NuGet

Update Magick.NET-Q16-AnyCPU to 14.10.4 or later

dotnet add package Magick.NET-Q16-AnyCPU --version 14.10.4

NuGet

Update Magick.NET-Q16-HDRI-OpenMP-x64 to 14.10.4 or later

dotnet add package Magick.NET-Q16-HDRI-OpenMP-x64 --version 14.10.4

NuGet

Update Magick.NET-Q8-OpenMP-x64 to 14.10.4 or later

dotnet add package Magick.NET-Q8-OpenMP-x64 --version 14.10.4

NuGet

Update Magick.NET-Q16-x86 to 14.10.4 or later

dotnet add package Magick.NET-Q16-x86 --version 14.10.4

After upgrading, run your dependency scanner again to confirm the vulnerability is resolved.

Affected Packages (19)

Package	Ecosystem	Affected	Fixed In
Magick.NET-Q16-x64	nuget	10.0.0, 10.1.0, 11.0.0, 11.1.0 (+222 more)	14.10.4
Magick.NET-Q16-OpenMP-x86	nuget	All versions	14.10.4
Magick.NET-Q8-arm64	nuget	10.0.0, 10.1.0, 11.0.0, 11.1.0 (+51 more)	14.10.4
Magick.NET-Q16-HDRI-OpenMP-arm64	nuget	10.0.0, 10.1.0, 11.0.0, 11.1.0 (+51 more)	14.10.4
Magick.NET-Q16-HDRI-AnyCPU	nuget	10.0.0, 10.1.0, 11.0.0, 11.1.0 (+203 more)	14.10.4
Magick.NET-Q8-OpenMP-arm64	nuget	10.0.0, 10.1.0, 11.0.0, 11.1.0 (+51 more)	14.10.4
Magick.NET-Q16-arm64	nuget	10.0.0, 10.1.0, 11.0.0, 11.1.0 (+51 more)	14.10.4
Magick.NET-Q8-x64	nuget	10.0.0, 10.1.0, 11.0.0, 11.1.0 (+222 more)	14.10.4
Magick.NET-Q16-HDRI-arm64	nuget	10.0.0, 10.1.0, 11.0.0, 11.1.0 (+51 more)	14.10.4
Magick.NET-Q16-HDRI-x86	nuget	10.0.0, 10.1.0, 11.0.0, 11.1.0 (+203 more)	14.10.4
Magick.NET-Q16-OpenMP-x64	nuget	10.0.0, 10.1.0, 11.0.0, 11.1.0 (+103 more)	14.10.4
Magick.NET-Q8-AnyCPU	nuget	10.0.0, 10.1.0, 11.0.0, 11.1.0 (+206 more)	14.10.4
Magick.NET-Q8-x86	nuget	10.0.0, 10.1.0, 11.0.0, 11.1.0 (+222 more)	14.10.4
Magick.NET-Q16-OpenMP-arm64	nuget	10.0.0, 10.1.0, 11.0.0, 11.1.0 (+51 more)	14.10.4
Magick.NET-Q16-HDRI-x64	nuget	10.0.0, 10.1.0, 11.0.0, 11.1.0 (+203 more)	14.10.4
Magick.NET-Q16-AnyCPU	nuget	10.0.0, 10.1.0, 11.0.0, 11.1.0 (+206 more)	14.10.4
Magick.NET-Q16-HDRI-OpenMP-x64	nuget	10.0.0, 10.1.0, 11.0.0, 11.1.0 (+103 more)	14.10.4
Magick.NET-Q8-OpenMP-x64	nuget	10.0.0, 10.1.0, 11.0.0, 11.1.0 (+103 more)	14.10.4
Magick.NET-Q16-x86	nuget	10.0.0, 10.1.0, 11.0.0, 11.1.0 (+222 more)	14.10.4

Vulnerability Classification

Common Weakness Enumeration (CWE) identifiers for this vulnerability type.

CWE-190
Integer OverflowMITRE

CVSS Score Breakdown

What the CVSS (Common Vulnerability Scoring System) 6.5 score means for each attack dimension.

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

High

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H

References

Frequently Asked Questions

What is CVE-2026-28493?: ImageMagick has Integer Overflow leading to out of bounds write in SIXEL decoder This vulnerability has been assigned a severity rating of MEDIUM (CVSS score: 6.5/10).
How do I check if my project is affected by CVE-2026-28493?: CVE-2026-28493 affects Magick.NET-Q16-x64, Magick.NET-Q16-OpenMP-x86 and Magick.NET-Q8-arm64 (and 16 more). Use GeekWala's free vulnerability scanner to check your dependencies against CVE-2026-28493 and 200,000+ other known vulnerabilities.

Severity & Exploitability

CVSS Score

6.5

Exploitation requires specific conditions or has limited impact. Remediate within weeks.

Also Known As

GHSA-r39q-jr8h-gcq2

Related CVEs

CVE-2026-28693
HIGH
ImageMagick: Integer overflow in DIB coder can result in out of bounds read or write
CVE-2026-28691
HIGH
ImageMagick has uninitialized pointer dereference in JBIG decoder
CVE-2026-31853
MEDIUM
ImageMagick is vulnerable to heap buffer over-write on 32-bit systems in SFW decoder
CVE-2026-30936
MEDIUM
ImageMagick has Heap Buffer Overflow in WaveletDenoiseImage
CVE-2026-30931
MEDIUM
ImageMagick has heap-based buffer overflow in UHDR encoder
CVE-2026-24484
MEDIUM
ImageMagick: Converting multi-layer nested MVG to SVG can cause DoS
CVE-2026-56366
LOW
ImageMagick: META reader memory leak in the APP1JPEG input path
CVE-2026-56378
LOW
ImageMagick: Malicious PCD files trigger 1‑byte heap Out-of-bounds Read and DoS

Check if you're affected

Scan your dependencies to see if this vulnerability affects your projects.

Scan Your Dependencies