ImageMagick is free and open-source software used for editing and manipulating digital images

CVE-2026-28693 is an integer-overflow bug in ImageMagick's DIB coder that can lead to out-of-bounds read or write when a target processes a crafted DIB/BMP-family image. Upstream says ImageMagick < 7.1.2-16 and ImageMagick 6 < 6.9.13-41 are affected; downstream Linux distros have issued their own backported fixed builds.

The vendor's HIGH 8.1 baseline overstates enterprise patch urgency for most fleets because AV:N only becomes true when you already have a reachable workflow that automatically hands attacker-supplied images to ImageMagick. In real deployments this is usually an upload, thumbnailing, document pipeline, mail pipeline, CMS, or internal batch converter problem; that exposure gate sharply narrows the reachable population, and there is no KEV listing, no public exploitation evidence, and no public weaponized PoC located in open sources for this CVE.

Why this verdict

• Exposure is conditional, not universal: start from vendor 8.1 HIGH, then subtract because ImageMagick is usually reached only through a file-processing workflow, not a native internet-facing service.
• Attack complexity is already high: the CNA vector includes AC:H, and there is no public exploit tooling to flatten that complexity for commodity attackers.
• Threat intel is cold: no CISA KEV listing, very low EPSS, and no public exploitation evidence found, so there is no signal that attackers are prioritizing this issue at scale.

Why not higher?

There is no current evidence that this CVE is being exploited in the wild, and no public PoC was found that would let low-skill actors operationalize it quickly. More importantly, most enterprises are not directly exposing a raw ImageMagick parser to the internet; they expose applications that may or may not pass attacker files into this code path.

Why not lower?

This is still memory corruption in a very common image-processing component, and many enterprises do have auto-processing upload paths where untrusted content is normalized without human review. If you run externally reachable media pipelines, mail sanitizers, or conversion workers, the reachable population inside your environment can be meaningful even if the global internet-facing population is not.

1. Block or de-prioritize DIB/BMP-family ingestion where possible — If your business does not require DIB/BMP uploads, reject them at the application layer, reverse proxy, mail gateway, and object-ingest APIs. For a MEDIUM verdict there is no mitigation SLA; use this immediately only on exposed workflows that cannot be patched soon.
2. Constrain ImageMagick worker privileges — Run conversion workers as non-root in containers or sandboxes with tight filesystem, process, and network permissions so a parser crash or memory-corruption event has limited blast radius. For MEDIUM, there is no mitigation SLA — go straight to the remediation window, but keep this in place as durable hardening.
3. Enforce format allowlists before ImageMagick — Validate MIME type and magic bytes with a pre-parser and route only approved formats into ImageMagick. This cuts off oddball or malformed containers before the vulnerable DIB coder ever runs; deploy where patch lag exists, even though MEDIUM has no formal mitigation deadline.
4. Monitor converter crash telemetry — Alert on repeated magick/convert crashes, container restarts, and failed image-processing jobs. This will not prevent exploitation, but it gives you fast signal if someone is probing the parser while you work through the 365-day remediation window.

Run this on the target Linux host or container image that has ImageMagick installed. Invoke it as bash check-cve-2026-28693.sh; no root is required for binary checks, but package-manager queries may work more reliably with local shell access to the host image.

#!/usr/bin/env bash
# check-cve-2026-28693.sh
# Determine likely exposure to CVE-2026-28693 on Linux hosts.
# Outputs one of: VULNERABLE / PATCHED / UNKNOWN
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

set -u

have_cmd() { command -v "$1" >/dev/null 2>&1; }
ver_ge() {
  # returns 0 if $1 >= $2 using version sort
  [ "$(printf '%s\n%s\n' "$2" "$1" | sort -V | head -n1)" = "$2" ]
}

upstream_version=""
if have_cmd magick; then
  upstream_version=$(magick -version 2>/dev/null | awk 'NR==1{print $3}')
elif have_cmd convert; then
  upstream_version=$(convert -version 2>/dev/null | awk 'NR==1{print $3}')
fi

# Upstream safe thresholds from GHSA/NVD
if [ -n "$upstream_version" ]; then
  if [[ "$upstream_version" =~ ^7\. ]]; then
    if ver_ge "$upstream_version" "7.1.2-16"; then
      echo "PATCHED"
      exit 0
    else
      echo "VULNERABLE"
      exit 1
    fi
  elif [[ "$upstream_version" =~ ^6\. ]]; then
    if ver_ge "$upstream_version" "6.9.13-41"; then
      echo "PATCHED"
      exit 0
    else
      echo "VULNERABLE"
      exit 1
    fi
  fi
fi

# Debian/Ubuntu backport awareness
if have_cmd dpkg-query; then
  pkgver=$(dpkg-query -W -f='${Version}\n' imagemagick 2>/dev/null | head -n1)
  if [ -n "$pkgver" ]; then
    if have_cmd dpkg && dpkg --compare-versions "$pkgver" ge "8:7.1.2.16+dfsg1-1"; then
      echo "PATCHED"
      exit 0
    fi
    if have_cmd dpkg && dpkg --compare-versions "$pkgver" ge "8:7.1.1.43+dfsg1-1+deb13u7"; then
      echo "PATCHED"
      exit 0
    fi
    if have_cmd dpkg && dpkg --compare-versions "$pkgver" ge "8:6.9.11.60+dfsg-1.6+deb12u8"; then
      echo "PATCHED"
      exit 0
    fi
    if have_cmd dpkg && dpkg --compare-versions "$pkgver" ge "8:6.9.11.60+dfsg-1.3+deb11u11"; then
      echo "PATCHED"
      exit 0
    fi
    echo "UNKNOWN"
    exit 2
  fi
fi

# RPM-based systems: package versions vary by backport policy.
# If we can only see package presence without a trusted mapping, be conservative.
if have_cmd rpm; then
  if rpm -q ImageMagick >/dev/null 2>&1 || rpm -q imagemagick >/dev/null 2>&1; then
    echo "UNKNOWN"
    exit 2
  fi
fi

echo "UNKNOWN"
exit 2

Sources

1. NVD CVE-2026-28693
2. GitHub Security Advisory GHSA-hffp-q43q-qq76
3. Ubuntu CVE tracker
4. Debian security tracker
5. SUSE CVE page
6. Amazon Linux CVE page
7. CISA Known Exploited Vulnerabilities Catalog
8. FIRST EPSS API endpoint for this CVE