4.8

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-28692

CVE-2026-28692: ImageMagick has a heap buffer over-read via 32-bit integer overflow in MAT decoder

In MAT decoder uses 32-bit arithmetic due to incorrect parenthesization resulting in a heap over-read.

=================================================================
==969652==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x506000003b40 at pc 0x555557b2a926 bp 0x7fffffff4c80 sp 0x7fffffff4c70
READ of size 8 at 0x506000003b40 thread T0

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-28692

CVE-2026-28692:

4.8

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
Magick.NET-Q16-AnyCPU	nuget	< 14.10.4	14.10.4
Magick.NET-Q16-HDRI-AnyCPU	nuget	< 14.10.4	14.10.4
Magick.NET-Q16-HDRI-OpenMP-arm64	nuget	< 14.10.4	14.10.4
Magick.NET-Q16-HDRI-OpenMP-x64	nuget	< 14.10.4	14.10.4
Magick.NET-Q16-HDRI-arm64	nuget	< 14.10.4	14.10.4
Magick.NET-Q16-HDRI-x64	nuget	< 14.10.4	14.10.4
Magick.NET-Q16-HDRI-x86	nuget	< 14.10.4	14.10.4
Magick.NET-Q16-OpenMP-arm64	nuget	< 14.10.4	14.10.4
Magick.NET-Q16-OpenMP-x64	nuget	< 14.10.4	14.10.4
Magick.NET-Q16-OpenMP-x86	nuget	< 14.10.4	14.10.4
Magick.NET-Q16-arm64	nuget	< 14.10.4	14.10.4
Magick.NET-Q16-x64	nuget	< 14.10.4	14.10.4
Magick.NET-Q16-x86	nuget	< 14.10.4	14.10.4
Magick.NET-Q8-AnyCPU	nuget	< 14.10.4	14.10.4
Magick.NET-Q8-OpenMP-arm64	nuget	< 14.10.4	14.10.4
Magick.NET-Q8-OpenMP-x64	nuget	< 14.10.4	14.10.4
Magick.NET-Q8-arm64	nuget	< 14.10.4	14.10.4
Magick.NET-Q8-x64	nuget	< 14.10.4	14.10.4
Magick.NET-Q8-x86	nuget	< 14.10.4	14.10.4

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability, described as a heap buffer over-read in the MAT decoder due to a 32-bit integer overflow from incorrect parenthesization, was traced to a specific commit in the ImageMagick repository. By comparing the tags for the patched version 7.1.2-16 and the preceding version, I identified the commit cb6cc0611baa4dac59add6439fa1d8af33fc5927 which explicitly references the GitHub security advisory GHSA-mrmj-x24c-wwcv. Analysis of this commit's patch shows changes in the coders/mat.c file within the ReadMATImage function. The changes correct the order of operations in calculating the ldblk variable. The vulnerable code performed a multiplication that could overflow a 32-bit integer before casting the result to a 64-bit ssize_t. The fix involves casting one of the operands to ssize_t before the multiplication, thus promoting the entire operation to 64-bit and preventing the integer overflow. This directly addresses the root cause described in the vulnerability report. Therefore, the ReadMATImage function is the vulnerable function.

Vulnerable functions

ReadMATImage

coders/mat.c

The vulnerability lies in the `ReadMATImage` function where the calculation for the block size `ldblk` is performed using 32-bit arithmetic. The expression `(ssize_t) (N * MATLAB_HDR.SizeX)` first calculates `N * MATLAB_HDR.SizeX` as a 32-bit integer, which can overflow if `MATLAB_HDR.SizeX` is large. The overflowed result is then cast to a 64-bit `ssize_t`, leading to a smaller-than-expected `ldblk` value. This incorrect size is then used in subsequent memory operations, causing a heap buffer over-read. The patch fixes this by casting `MATLAB_HDR.SizeX` to `ssize_t` before the multiplication, ensuring the calculation is done in 64-bit arithmetic and preventing the overflow.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.