{
  "threat_severity" : "Moderate",
  "public_date" : "2026-03-09T21:33:15Z",
  "bugzilla" : {
    "description" : "ImageMagick: ImageMagick: Denial of Service via heap-buffer-overflow in PCL encode",
    "id" : "2445889",
    "url" : "https://bugzilla.redhat.com/show_bug.cgi?id=2445889"
  },
  "cvss3" : {
    "cvss3_base_score" : "6.8",
    "cvss3_scoring_vector" : "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H",
    "status" : "draft"
  },
  "cwe" : "CWE-131",
  "details" : [ "ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-16 and 6.9.13-41, A heap-buffer-overflow vulnerability exists in the PCL encode due to an undersized output buffer allocation. This vulnerability is fixed in 7.1.2-16 and 6.9.13-41.", "A flaw was found in ImageMagick, free and open-source software used for editing and manipulating digital images. A local attacker could exploit a heap-buffer-overflow vulnerability in the PCL encode due to an undersized output buffer allocation. This could lead to a denial of service (DoS), making the software unavailable, and potentially impact data integrity." ],
  "statement" : "This MODERATE impact vulnerability in ImageMagick involves a heap-buffer-overflow within the PCL encoder. Processing a specially crafted image could trigger this flaw, potentially leading to denial of service or other impacts. This affects Red Hat Enterprise Linux 6 ELS and 7 ELS, as well as community projects like Fedora and EPEL, where ImageMagick is used for image processing.",
  "package_state" : [ {
    "product_name" : "Red Hat Enterprise Linux 6",
    "fix_state" : "Out of support scope",
    "package_name" : "ImageMagick",
    "cpe" : "cpe:/o:redhat:enterprise_linux:6"
  }, {
    "product_name" : "Red Hat Enterprise Linux 7",
    "fix_state" : "Out of support scope",
    "package_name" : "ImageMagick",
    "cpe" : "cpe:/o:redhat:enterprise_linux:7"
  } ],
  "references" : [ "https://www.cve.org/CVERecord?id=CVE-2026-28686\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-28686\nhttps://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-467j-76j7-5885" ],
  "name" : "CVE-2026-28686",
  "mitigation" : {
    "value" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
    "lang" : "en:us"
  },
  "csaw" : false
}