Skip to main content

ImageMagick CVE-2026-40183

| EUVDEUVD-2026-22114 MEDIUM
Heap-based Buffer Overflow (CWE-122)
2026-04-13 GitHub_M GHSA-jvgr-9ph5-m8v4
Buffer Overflow Heap Overflow Imagemagick
5.5
CVSS 3.1 · GitHub Advisory
Share

Severity by source

GitHub Advisory PRIMARY
5.5 MEDIUM
AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
vuln.today AI
5.5 MEDIUM

Local invocation with user-initiated 16-bit float JXL encoding required; no elevated privileges needed; DoS-only impact with no scope change.

3.1 AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
4.0 AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
MEDIUM
qualitative
Red Hat
5.5 MEDIUM
qualitative

Primary rating from GitHub Advisory.

CVSS VectorGitHub Advisory

Attack Vector
Local
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

5
Source Code Evidence Fetched
Jul 24, 2026 - 07:55 vuln.today
Analysis Generated
Jul 24, 2026 - 07:55 vuln.today
Patch released
Apr 14, 2026 - 20:30 nvd
Patch available
EUVD ID Assigned
Apr 13, 2026 - 21:45 euvd
EUVD-2026-22114
CVE Published
Apr 13, 2026 - 21:28 nvd
MEDIUM 5.5

DescriptionGitHub Advisory

ImageMagick is free and open-source software used for editing and manipulating digital images. In versions below 7.1.2-19, the JXL encoder has an heap write overflow when a user specifies that the image should be encoded as 16 bit floats. This issue has been fixed in version 7.1.2-19.

AnalysisAI

Heap write overflow in ImageMagick's JXL encoder crashes the process when 16-bit float encoding is requested, affecting all versions below 7.1.2-19 and Magick.NET NuGet packages below 14.12.0. The overflow writes out-of-bounds to heap memory, causing a denial-of-service condition with no confidentiality or integrity impact. No public exploit has been identified at time of analysis and EPSS sits at 0.01% (2nd percentile), consistent with SSVC assessment of zero active exploitation.

Technical ContextAI

CWE-122 (Heap-Based Buffer Overflow) identifies the root cause: the JXL (JPEG XL) encoder miscalculates or under-allocates heap buffer size when converting pixel data to 16-bit floating-point representation, resulting in an out-of-bounds write. JXL is a modern image codec; the encoder likely assumes a smaller per-pixel byte width when sizing the output buffer. The affected codebase spans the core ImageMagick C library (CPE: cpe:2.3:a:imagemagick:imagemagick:*:*:*:*:*:*:*:*) and its .NET wrapper Magick.NET distributed as multiple NuGet packages (Q16, Q16-HDRI variants for AnyCPU, arm64, and OpenMP targets). Red Hat and SUSE distribution tags indicate this vulnerability is tracked in their security errata pipelines.

RemediationAI

Upgrade ImageMagick to version 7.1.2-19 or later, available at https://github.com/ImageMagick/ImageMagick/releases/tag/7.1.2-19 with the fix commit at https://github.com/ImageMagick/ImageMagick/commit/1c7767fc5f822c6edc104c1220d523e96fa20b5a. For .NET consumers, upgrade all Magick.NET NuGet packages (Q16 and Q16-HDRI variants) to version 14.12.0 or later via https://github.com/dlemstra/Magick.NET/releases/tag/14.12.0. Red Hat and SUSE users should apply distribution-provided security updates through their standard package management channels. As a compensating control where immediate patching is not possible, restrict JXL encoding in 16-bit float mode by sanitizing or blocking the relevant encoding depth parameter at the application wrapper layer before passing arguments to ImageMagick; note this disables a specific encoding feature but does not affect other image operations.

More in Imagemagick

View all
CVE-2017-15277 MEDIUM POC
6.5 Oct 12

ReadGIFImage in coders/gif.c in ImageMagick 7.0.6-1 and GraphicsMagick 1.3.26 leaves the palette uninitialized when proc
CVE-2016-5841 CRITICAL POC
9.8 Dec 13

Integer overflow in MagickCore/profile.c in ImageMagick before 7.0.2-1 allows remote attackers to cause a denial of serv
CVE-2016-3717 MEDIUM POC
5.5 May 05

The LABEL coder in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allows remote attackers to read arbitrary files vi
CVE-2016-5118 CRITICAL
9.8 Jun 10

The OpenBlob function in blob.c in GraphicsMagick before 1.3.24 and ImageMagick allows remote attackers to execute arbit
CVE-2016-5689 CRITICAL POC
9.8 Dec 13

The DCM reader in ImageMagick before 6.9.4-5 and 7.x before 7.0.1-7 allows remote attackers to have unspecified impact b
CVE-2016-5690 CRITICAL POC
9.8 Dec 13

The ReadDCMImage function in DCM reader in ImageMagick before 6.9.4-5 and 7.x before 7.0.1-7 allows remote attackers to

CVE-2016-5691 CRITICAL POC
9.8 Dec 13

The DCM reader in ImageMagick before 6.9.4-5 and 7.x before 7.0.1-7 allows remote attackers to have unspecified impact b
CVE-2017-14138 CRITICAL POC
9.8 Sep 04

ImageMagick 7.0.6-5 has a memory leak vulnerability in ReadWEBPImage in coders/webp.c because memory is not freed in cer
CVE-2026-23876 CRITICAL POC
9.8 Jan 20

Heap buffer overflow in ImageMagick's XBM image decoder (ReadXBMImage) lets remote attackers write attacker-controlled d
CVE-2023-34152 CRITICAL POC
9.8 May 30

A vulnerability was found in ImageMagick. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable
CVE-2019-19952 CRITICAL POC
9.8 Dec 24

In ImageMagick 7.0.9-7 Q16, there is a use-after-free in the function MngInfoDiscardObject of coders/png.c, related to R
CVE-2018-14551 CRITICAL POC
9.8 Jul 23

The ReadMATImageV4 function in coders/mat.c in ImageMagick 7.0.8-7 uses an uninitialized variable, leading to memory cor

Same weakness CWE-122 – Heap-based Buffer Overflow

View all
CVE-2023-4911 HIGH POC
7.8
CVE-2023-27997 CRITICAL
9.8
CVE-2025-24985 HIGH POC
7.8
CVE-2026-53362 HIGH POC
7.8
CVE-2025-21418 HIGH
7.8
CVE-2023-23376 HIGH
7.8
CVE-2025-24993 HIGH
7.8
CVE-2024-30085 HIGH POC
7.8

Same technique Buffer Overflow

View all
CVE-2017-7269 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2020-0796 CRITICAL POC
10.0
CVE-2019-11043 CRITICAL POC
9.8
CVE-2009-0927 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Medium
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed
SUSE Linux Enterprise Module for Desktop Applications 15 SP7 Fixed
SUSE Linux Enterprise Module for Development Tools 15 SP7 Fixed
SUSE Linux Enterprise Module for Package Hub 15 SP7 Fixed

Share

CVE-2026-40183 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy