ImageMagick has an uninitialized pointer dereference in JBIG decoder

Root Cause CVE-2026-28691 is an uninitialized pointer dereference vulnerability in ImageMagick's JBIG decoder [1][2]. The flaw arises from a missing check that allows a pointer to be used without proper initialization, leading to undefined behavior when processing specially crafted JBIG images [4].

Exploitation An attacker can exploit this vulnerability by supplying a malicious JBIG image to an application or service that uses ImageMagick to process images [2]. No authentication is required, and the attack can be performed remotely if the application accepts user-uploaded images [4]. The complexity is low, as the crafted image can be delivered via common channels such as email, web uploads, or file sharing.

Impact Successful exploitation could result in a denial of service due to application crash, or potentially allow arbitrary code execution in the context of the vulnerable process [3][4]. The severity is rated as critical, given the widespread use of ImageMagick in web services, content management systems, and image processing pipelines.

Mitigation The vulnerability is fixed in ImageMagick versions 7.1.2-16 and 6.9.13-41 [2][3]. Users are strongly advised to update immediately. No workarounds are available; disabling JBIG support via policy may reduce risk but is not a complete mitigation.