ImageMagick has a Integer Overflow leading to out of bounds write in SIXEL decoder

Vulnerability

CVE-2026-28493 is an integer overflow vulnerability in the SIXEL decoder of ImageMagick, a widely used image processing library [1]. The flaw exists in versions prior to 7.1.2-16 and can be triggered when processing a specially crafted image, leading to an out-of-bounds write [2].

Exploitation

An attacker can exploit this vulnerability by supplying a malicious SIXEL image to ImageMagick. No authentication is required, and the attack can be delivered remotely if the application processes user-supplied images. The integer overflow causes incorrect memory allocation or bounds checking, resulting in a write beyond the allocated buffer [4].

Impact

Successful exploitation could allow an attacker to corrupt memory, potentially leading to arbitrary code execution or denial of service. The severity is elevated due to the lack of authentication and the potential for remote exploitation [2].

Mitigation

The vulnerability is patched in ImageMagick version 7.1.2-16 [3]. Users should update to this version or later. There are no known workarounds; processing untrusted images with older versions is not recommended [4].