Fluid Attacks Database

Description

ImageMagick has Integer Overflow leading to out of bounds write in SIXEL decoder An integer overflow vulnerability exists in the SIXEL decoer. The vulnerability allows an attacker to perform an out of bounds via a specially crafted mage.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Package	Affected version	Patched versions
debian 13	imagemagick	=8:7.1.1.43+dfsg1-1 \|\| =8:7.1.1.43+dfsg1-1+deb13u1 \|\| =8:7.1.1.43+dfsg1-1+deb13u2 \|\| =8:7.1.1.43+dfsg1-1+deb13u3 \|\| =8:7.1.1.43+dfsg1-1+deb13u4 \|\| =8:7.1.1.43+dfsg1-1+deb13u5 \|\| =8:7.1.1.43+dfsg1-1+deb13u6 \|\| >=0 <8:7.1.1.43+dfsg1-1+deb13u7	8:7.1.1.43+dfsg1-1+deb13u7
debian 14	imagemagick	=8:7.1.1.43+dfsg1-1 \|\| =8:7.1.1.46+dfsg1-1 \|\| =8:7.1.1.47+dfsg1-1 \|\| =8:7.1.1.47+dfsg1-2 \|\| =8:7.1.2.1+dfsg1-1 \|\| =8:7.1.2.12+dfsg1-1 \|\| =8:7.1.2.13+dfsg1-1 \|\| =8:7.1.2.15+dfsg1-1 \|\| =8:7.1.2.15+dfsg1-2 \|\| =8:7.1.2.3+dfsg1-1 \|\| =8:7.1.2.7+dfsg1-1 \|\| =8:7.1.2.8+dfsg1-1 \|\| >=0 <8:7.1.2.16+dfsg1-1	8:7.1.2.16+dfsg1-1
nuget	magick.net-q8-openmp-arm64	>=0 <14.10.4	14.10.4
nuget	magick.net-q16-arm64	>=0 <14.10.4	14.10.4
nuget	magick.net-q8-anycpu	>=0 <14.10.4	14.10.4
nuget	magick.net-q16-hdri-x64	>=0 <14.10.4	14.10.4
rpm rhel6	ImageMagick	-	-
nuget	magick.net-q16-openmp-x86	>=0 <14.10.4	14.10.4
nuget	magick.net-q8-openmp-x64	>=0 <14.10.4	14.10.4
nuget	magick.net-q8-arm64	>=0 <14.10.4	14.10.4

1-10 of 23

Aliases

1. CVE-2026-284932. NVD-2026-284933. OSV-DEBIAN-2026-284934. OSV-2026-284935. GHSA-r39q-jr8h-gcq26. GCVE-2026-284937. SECURITY-TRACKER-CVE-2026-28493

References

1. https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-r39q-jr8h-gcq22. https://github.com/dlemstra/Magick.NET/releases/tag/14.10.4