ImageMagick affected by stack corruption through long morphology kernel names or arrays

CVE-2026-28494 is a stack buffer overflow vulnerability in ImageMagick's morphology kernel parsing functions [2]. The root cause is that user-controlled kernel strings exceeding a buffer are copied into fixed-size stack buffers via memcpy without bounds checking, leading to stack corruption [4].

Exploitation requires an attacker to supply a long morphology kernel name or array [3]. The attack vector is network-based with low complexity, no privileges required, and no user interaction needed [4]. This makes the vulnerability remotely exploitable without authentication.

Successful exploitation can lead to stack corruption, potentially allowing an attacker to impact confidentiality, integrity, and availability of the system [4]. The advisory notes that the severity is high, with possible data access, modification, or service disruption [3].

The vulnerability is fixed in ImageMagick versions 7.1.2-16 and 6.9.13-41 [2]. The Magick.NET release 14.10.4 incorporates these fixes [3]. Users should update to these versions or apply the vendor-provided patches.