Skip to main content

ImageMagick CVE-2026-40169

| EUVDEUVD-2026-22113 MEDIUM
Heap-based Buffer Overflow (CWE-122)
2026-04-13 GitHub_M GHSA-5592-p365-24xh
Buffer Overflow Heap Overflow Imagemagick
6.2
CVSS 3.1 · GitHub Advisory
Share

Severity by source

GitHub Advisory PRIMARY
6.2 MEDIUM
AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
vuln.today AI
6.2 MEDIUM

Local file supply triggers the overflow; no privileges or interaction needed; impact is crash only, no confidentiality or integrity consequence.

3.1 AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
4.0 AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
MEDIUM
qualitative
Red Hat
6.5 MEDIUM
qualitative

Primary rating from GitHub Advisory.

CVSS VectorGitHub Advisory

Attack Vector
Local
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

5
Source Code Evidence Fetched
Jul 24, 2026 - 07:56 vuln.today
Analysis Generated
Jul 24, 2026 - 07:56 vuln.today
Patch released
Apr 14, 2026 - 20:30 nvd
Patch available
EUVD ID Assigned
Apr 13, 2026 - 21:45 euvd
EUVD-2026-22113
CVE Published
Apr 13, 2026 - 21:25 nvd
MEDIUM 6.2

DescriptionGitHub Advisory

ImageMagick is free and open-source software used for editing and manipulating digital images. In versions below 7.1.2-19, a crafted image could result in an out of bounds heap write when writing a yaml or json output, resulting in a crash. This issue has been fixed in version 7.1.2-19.

AnalysisAI

Heap-based buffer overflow in ImageMagick's YAML and JSON encoders allows a local attacker to crash the process by supplying a crafted image file converted to YAML or JSON output format. All ImageMagick versions below 7.1.2-19 are affected, including multiple Magick.NET NuGet packages below 14.12.0. A public proof-of-concept exploit exists, but EPSS remains at 0.01% (2nd percentile) and SSVC classifies exploitation as 'none', indicating no observed active exploitation at time of analysis.

Technical ContextAI

The root cause is CWE-122 (Heap-based Buffer Overflow) located in the EncodeImageAttributes function within coders/json.c and coders/yaml.c. When iterating over entries in image->directory to produce JSON or YAML output, the inner pointer loop increments q through the directory string without bounding q relative to sizeof(image_info->filename). This allows an attacker-controlled crafted image whose directory data exceeds that buffer boundary to cause a single out-of-bounds heap write, ultimately crashing the process. The fix (commit f86452a8aea37bf2b4bd36127f836dcc5f138b38) adds the guard ((size_t)(q-p) < sizeof(image_info->filename)) to the inner while loop and corrects pointer advancement logic in both encoders. The affected CPE is cpe:2.3:a:imagemagick:imagemagick:*:*:*:*:*:*:*:* for ImageMagick core and the nuget/Magick.NET family of .NET wrappers.

RemediationAI

Upgrade ImageMagick to version 7.1.2-19 or later, available at https://github.com/ImageMagick/ImageMagick/releases/tag/7.1.2-19, which contains the patched coders/json.c and coders/yaml.c. For .NET consumers, upgrade all Magick.NET NuGet packages (Magick.NET-Q16-AnyCPU, Magick.NET-Q16-HDRI-AnyCPU, Magick.NET-Q16-HDRI-OpenMP-arm64, Magick.NET-Q16-HDRI-arm64) to version 14.12.0 or later, available at https://github.com/dlemstra/Magick.NET/releases/tag/14.12.0. If immediate patching is not feasible, a targeted workaround is to disable or prohibit YAML and JSON output formats in ImageMagick policy.xml by adding deny rules for the YAML and JSON delegates - this prevents the vulnerable encoder code path from executing entirely, though it will break any workflow that relies on those output formats. Red Hat and SUSE advisories should be monitored for distribution-packaged updates.

More in Imagemagick

View all
CVE-2017-15277 MEDIUM POC
6.5 Oct 12

ReadGIFImage in coders/gif.c in ImageMagick 7.0.6-1 and GraphicsMagick 1.3.26 leaves the palette uninitialized when proc
CVE-2016-5841 CRITICAL POC
9.8 Dec 13

Integer overflow in MagickCore/profile.c in ImageMagick before 7.0.2-1 allows remote attackers to cause a denial of serv
CVE-2016-3717 MEDIUM POC
5.5 May 05

The LABEL coder in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allows remote attackers to read arbitrary files vi
CVE-2016-5118 CRITICAL
9.8 Jun 10

The OpenBlob function in blob.c in GraphicsMagick before 1.3.24 and ImageMagick allows remote attackers to execute arbit
CVE-2016-5689 CRITICAL POC
9.8 Dec 13

The DCM reader in ImageMagick before 6.9.4-5 and 7.x before 7.0.1-7 allows remote attackers to have unspecified impact b
CVE-2016-5690 CRITICAL POC
9.8 Dec 13

The ReadDCMImage function in DCM reader in ImageMagick before 6.9.4-5 and 7.x before 7.0.1-7 allows remote attackers to

CVE-2016-5691 CRITICAL POC
9.8 Dec 13

The DCM reader in ImageMagick before 6.9.4-5 and 7.x before 7.0.1-7 allows remote attackers to have unspecified impact b
CVE-2017-14138 CRITICAL POC
9.8 Sep 04

ImageMagick 7.0.6-5 has a memory leak vulnerability in ReadWEBPImage in coders/webp.c because memory is not freed in cer
CVE-2026-23876 CRITICAL POC
9.8 Jan 20

Heap buffer overflow in ImageMagick's XBM image decoder (ReadXBMImage) lets remote attackers write attacker-controlled d
CVE-2023-34152 CRITICAL POC
9.8 May 30

A vulnerability was found in ImageMagick. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable
CVE-2019-19952 CRITICAL POC
9.8 Dec 24

In ImageMagick 7.0.9-7 Q16, there is a use-after-free in the function MngInfoDiscardObject of coders/png.c, related to R
CVE-2018-14551 CRITICAL POC
9.8 Jul 23

The ReadMATImageV4 function in coders/mat.c in ImageMagick 7.0.8-7 uses an uninitialized variable, leading to memory cor

Same weakness CWE-122 – Heap-based Buffer Overflow

View all
CVE-2023-4911 HIGH POC
7.8
CVE-2023-27997 CRITICAL
9.8
CVE-2025-24985 HIGH POC
7.8
CVE-2026-53362 HIGH POC
7.8
CVE-2025-21418 HIGH
7.8
CVE-2023-23376 HIGH
7.8
CVE-2025-24993 HIGH
7.8
CVE-2024-30085 HIGH POC
7.8

Same technique Buffer Overflow

View all
CVE-2017-7269 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2020-0796 CRITICAL POC
10.0
CVE-2019-11043 CRITICAL POC
9.8
CVE-2009-0927 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Medium
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed
SUSE Linux Enterprise Module for Desktop Applications 15 SP7 Fixed
SUSE Linux Enterprise Module for Development Tools 15 SP7 Fixed
SUSE Linux Enterprise Module for Package Hub 15 SP7 Fixed

Share

CVE-2026-40169 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy