Skip to main content

ImageMagick CVE-2026-40310

| EUVDEUVD-2026-22116 MEDIUM
Heap-based Buffer Overflow (CWE-122)
2026-04-13 GitHub_M GHSA-pwg5-6jfc-crvh
Buffer Overflow Heap Overflow Imagemagick
5.5
CVSS 3.1 · GitHub Advisory
Share

Severity by source

GitHub Advisory PRIMARY
5.5 MEDIUM
AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
vuln.today AI
5.5 MEDIUM

Local vector because trigger requires invoking the JP2 encoder locally; UI:R because a user must initiate encoding; only availability impacted via process crash.

3.1 AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
4.0 AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
MEDIUM
qualitative
Red Hat
6.5 MEDIUM
qualitative

Primary rating from GitHub Advisory.

CVSS VectorGitHub Advisory

Attack Vector
Local
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

5
Source Code Evidence Fetched
Jul 24, 2026 - 07:51 vuln.today
Analysis Generated
Jul 24, 2026 - 07:51 vuln.today
Patch released
Apr 14, 2026 - 20:30 nvd
Patch available
EUVD ID Assigned
Apr 13, 2026 - 21:45 euvd
EUVD-2026-22116
CVE Published
Apr 13, 2026 - 21:32 nvd
MEDIUM 5.5

DescriptionGitHub Advisory

ImageMagick is free and open-source software used for editing and manipulating digital images. Versions below both 7.1.2-19 and 6.9.13-44, contain a heap out-of-bounds write in the JP2 encoder with when a user specifies an invalid sampling index. This issue has been fixed in versions 6.9.13-44 and 7.1.2-19.

AnalysisAI

Heap out-of-bounds write in ImageMagick's JP2 (JPEG 2000) encoder affects all versions of the 7.x branch below 7.1.2-19 and the 6.x branch below 6.9.13-44, as well as the Magick.NET .NET bindings below 14.12.0. When a user specifies an invalid (zero or negative) subsampling index during JP2 encoding, the subsampling_dx and subsampling_dy parameters are cast to int without clamping, enabling a write beyond the allocated heap buffer. The attack vector is local with required user interaction (AV:L/UI:R), EPSS is 0.01% (2nd percentile), SSVC classifies exploitation as none and non-automatable, and no public exploit or KEV listing exists - placing this firmly in the low-urgency remediation tier for most environments.

Technical ContextAI

ImageMagick is a free, open-source image manipulation library and CLI suite supporting dozens of image formats. The vulnerability resides in coders/jp2.c within the WriteJP2Image function, where user-controlled subsampling parameters (geometry_info.rho and geometry_info.sigma) were cast directly to int without bounds enforcement: parameters->subsampling_dx=(int) geometry_info.rho. An invalid value (e.g., zero or negative) produces an out-of-bounds write on the heap when the JP2 encoder subsequently uses that index. The fix (commit 3d653bea2df085c728a1c8f775808e1e9249dff9) wraps both assignments with MagickMax(..., 1.0) to enforce a minimum valid subsampling factor of 1. CWE-122 (Heap-based Buffer Overflow) describes this root-cause class. The Magick.NET .NET binding packages (Q16-AnyCPU, Q16-HDRI-AnyCPU, Q16-HDRI-OpenMP-arm64, Q16-HDRI-x64) wrap the native ImageMagick library and inherit this flaw. CPE cpe:2.3:a:imagemagick:imagemagick:*:*:*:*:*:*:*:* covers the full affected range.

RemediationAI

Upgrade ImageMagick to version 7.1.2-19 or later (https://github.com/ImageMagick/ImageMagick/releases/tag/7.1.2-19) for 7.x deployments, or to 6.9.13-44 for legacy 6.x deployments. For .NET applications using Magick.NET, upgrade to version 14.12.0 or later (https://github.com/dlemstra/Magick.NET/releases/tag/14.12.0). The source-level fix is available in commit 3d653bea2df085c728a1c8f775808e1e9249dff9. Where immediate patching is not feasible, disable JP2/JPEG 2000 encoder support in ImageMagick policy.xml (set rights="none" for the JP2 format) to eliminate the vulnerable code path - the trade-off is loss of JPEG 2000 write capability. For image processing services that accept user-supplied encoding parameters, sanitize or reject subsampling index values below 1 at the application layer as an interim control.

More in Imagemagick

View all
CVE-2017-15277 MEDIUM POC
6.5 Oct 12

ReadGIFImage in coders/gif.c in ImageMagick 7.0.6-1 and GraphicsMagick 1.3.26 leaves the palette uninitialized when proc
CVE-2016-5841 CRITICAL POC
9.8 Dec 13

Integer overflow in MagickCore/profile.c in ImageMagick before 7.0.2-1 allows remote attackers to cause a denial of serv
CVE-2016-3717 MEDIUM POC
5.5 May 05

The LABEL coder in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allows remote attackers to read arbitrary files vi
CVE-2016-5118 CRITICAL
9.8 Jun 10

The OpenBlob function in blob.c in GraphicsMagick before 1.3.24 and ImageMagick allows remote attackers to execute arbit
CVE-2016-5689 CRITICAL POC
9.8 Dec 13

The DCM reader in ImageMagick before 6.9.4-5 and 7.x before 7.0.1-7 allows remote attackers to have unspecified impact b
CVE-2016-5690 CRITICAL POC
9.8 Dec 13

The ReadDCMImage function in DCM reader in ImageMagick before 6.9.4-5 and 7.x before 7.0.1-7 allows remote attackers to

CVE-2016-5691 CRITICAL POC
9.8 Dec 13

The DCM reader in ImageMagick before 6.9.4-5 and 7.x before 7.0.1-7 allows remote attackers to have unspecified impact b
CVE-2017-14138 CRITICAL POC
9.8 Sep 04

ImageMagick 7.0.6-5 has a memory leak vulnerability in ReadWEBPImage in coders/webp.c because memory is not freed in cer
CVE-2026-23876 CRITICAL POC
9.8 Jan 20

Heap buffer overflow in ImageMagick's XBM image decoder (ReadXBMImage) lets remote attackers write attacker-controlled d
CVE-2023-34152 CRITICAL POC
9.8 May 30

A vulnerability was found in ImageMagick. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable
CVE-2019-19952 CRITICAL POC
9.8 Dec 24

In ImageMagick 7.0.9-7 Q16, there is a use-after-free in the function MngInfoDiscardObject of coders/png.c, related to R
CVE-2018-14551 CRITICAL POC
9.8 Jul 23

The ReadMATImageV4 function in coders/mat.c in ImageMagick 7.0.8-7 uses an uninitialized variable, leading to memory cor

Same weakness CWE-122 – Heap-based Buffer Overflow

View all
CVE-2023-4911 HIGH POC
7.8
CVE-2023-27997 CRITICAL
9.8
CVE-2025-24985 HIGH POC
7.8
CVE-2026-53362 HIGH POC
7.8
CVE-2025-21418 HIGH
7.8
CVE-2023-23376 HIGH
7.8
CVE-2025-24993 HIGH
7.8
CVE-2024-30085 HIGH POC
7.8

Same technique Buffer Overflow

View all
CVE-2017-7269 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2020-0796 CRITICAL POC
10.0
CVE-2019-11043 CRITICAL POC
9.8
CVE-2009-0927 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Medium
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed
SUSE Linux Enterprise Module for Desktop Applications 15 SP7 Fixed
SUSE Linux Enterprise Module for Development Tools 15 SP7 Fixed
SUSE Linux Enterprise Module for Package Hub 15 SP7 Fixed

Share

CVE-2026-40310 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy