ImageMagick has a Heap Use-After-Free in ImageMagick MSL decoder

Overview

CVE-2026-28687 describes a heap use-after-free vulnerability in the MSL (Magick Scripting Language) decoder of ImageMagick. The flaw exists in versions prior to 7.1.2-16 and 6.9.13-41. When processing a specially crafted MSL file, the decoder may access memory that has already been freed, leading to memory corruption [2][4].

Exploitation

An attacker can exploit this vulnerability by supplying a malicious MSL file to an application that uses ImageMagick to process images. No authentication or special privileges are required; the threat is triggered when the crafted file is opened or parsed by the affected decoder [4]. This attack vector is common in environments where ImageMagick processes user-uploaded images without proper validation.

Impact

Successful exploitation results in a heap use-after-free condition, potentially causing the application to crash or behave unpredictably. While the advisory does not explicitly confirm remote code execution, such memory corruption vulnerabilities often lead to arbitrary code execution if combined with other techniques [2]. Users are advised to treat this as a high-risk issue.

Mitigation

The vulnerability has been patched in ImageMagick 7.1.2-16 and 6.9.13-41. All users are strongly recommended to update to these fixed versions immediately. No workarounds are currently available [4].