Skip to main content

ImageMagick CVE-2026-40311

| EUVDEUVD-2026-22130 MEDIUM
Use After Free (CWE-416)
2026-04-13 GitHub_M GHSA-r83h-crwp-3vm7
Denial Of Service Memory Corruption Use After Free Imagemagick
5.5
CVSS 3.1 · GitHub Advisory
Share

Severity by source

GitHub Advisory PRIMARY
5.5 MEDIUM
AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
vuln.today AI
5.5 MEDIUM

AV:L/UI:R because exploitation requires delivering a crafted image file for local processing; PR:N since no system privileges are needed; A:H for crash; C:N/I:N as only availability is impacted.

3.1 AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
4.0 AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
MEDIUM
qualitative
Red Hat
5.5 MEDIUM
qualitative

Primary rating from GitHub Advisory.

CVSS VectorGitHub Advisory

Attack Vector
Local
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

5
Source Code Evidence Fetched
Jul 24, 2026 - 07:51 vuln.today
Analysis Generated
Jul 24, 2026 - 07:51 vuln.today
Patch released
Apr 14, 2026 - 20:30 nvd
Patch available
EUVD ID Assigned
Apr 13, 2026 - 22:00 euvd
EUVD-2026-22130
CVE Published
Apr 13, 2026 - 21:36 nvd
MEDIUM 5.5

DescriptionGitHub Advisory

ImageMagick is free and open-source software used for editing and manipulating digital images. Versions below 7.1.2-19 and 6.9.13-44 contain a heap use-after-free vulnerability that can cause a crash when reading and printing values from an invalid XMP profile. This issue has been fixed in versions 6.9.13-44 and 7.1.2-19.

AnalysisAI

Heap use-after-free in ImageMagick's XMP metadata parser crashes the process when reading a malformed or invalid XMP profile embedded in an image file. Both the primary 7.x branch (below 7.1.2-19) and the legacy 6.x branch (below 6.9.13-44) are affected, along with Magick.NET bindings below 14.12.0. Impact is limited to denial of service via process crash - no confidentiality or integrity impact has been identified - and no public exploit or KEV listing exists, with EPSS at 0.01% (3rd percentile) confirming very low exploitation probability.

Technical ContextAI

The vulnerability resides in MagickCore/property.c within the GetXMPProperty() function. When ImageMagick processes an XMP (Extensible Metadata Platform) profile - an XML-based metadata standard embedded in image formats such as JPEG, PNG, and TIFF - it iterates over XML tree nodes, constructs namespace-prefixed property strings, and inserts them into a splay tree. In vulnerable versions, the xmp_namespace pointer was passed to AddValueToSplayTree() and then referenced again during value printing after the underlying memory could be reclaimed, triggering a CWE-416 heap use-after-free. The published commit diff (5facfecf1abb3fed46a08f614dcc43d1e548e20d) confirms the fix: the property string is now constructed, validated for format correctness (checking for namespace suffix ':*'), added to the splay tree as an independent copy via ConstantString(), and then explicitly destroyed with DestroyString() - eliminating the dangling reference. Affected CPE is cpe:2.3:a:imagemagick:imagemagick:*:*:*:*:*:*:*:* covering all platform variants.

RemediationAI

Upgrade ImageMagick to version 7.1.2-19 or later (https://github.com/ImageMagick/ImageMagick/releases/tag/7.1.2-19) for the 7.x branch, or to 6.9.13-44 or later for legacy 6.x deployments; the fix is implemented in commit 5facfecf1abb3fed46a08f614dcc43d1e548e20d. Magick.NET users should upgrade to version 14.12.0 or later (https://github.com/dlemstra/Magick.NET/releases/tag/14.12.0). For environments where patching is not immediately feasible, consider stripping XMP metadata from image files before they reach ImageMagick using an independently patched tool such as ExifTool (note: this adds pipeline complexity and may remove legitimate metadata). Running ImageMagick within a sandboxed process (e.g., a container with resource limits, or with seccomp/AppArmor profiles) limits the impact of a crash to the sandboxed unit rather than the broader service. Restricting accepted image formats to those that do not embed XMP - where operationally viable - eliminates the vulnerable code path but trades off format support.

More in Imagemagick

View all
CVE-2017-15277 MEDIUM POC
6.5 Oct 12

ReadGIFImage in coders/gif.c in ImageMagick 7.0.6-1 and GraphicsMagick 1.3.26 leaves the palette uninitialized when proc
CVE-2016-5841 CRITICAL POC
9.8 Dec 13

Integer overflow in MagickCore/profile.c in ImageMagick before 7.0.2-1 allows remote attackers to cause a denial of serv
CVE-2016-3717 MEDIUM POC
5.5 May 05

The LABEL coder in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allows remote attackers to read arbitrary files vi
CVE-2016-5118 CRITICAL
9.8 Jun 10

The OpenBlob function in blob.c in GraphicsMagick before 1.3.24 and ImageMagick allows remote attackers to execute arbit
CVE-2016-5689 CRITICAL POC
9.8 Dec 13

The DCM reader in ImageMagick before 6.9.4-5 and 7.x before 7.0.1-7 allows remote attackers to have unspecified impact b
CVE-2016-5690 CRITICAL POC
9.8 Dec 13

The ReadDCMImage function in DCM reader in ImageMagick before 6.9.4-5 and 7.x before 7.0.1-7 allows remote attackers to

CVE-2016-5691 CRITICAL POC
9.8 Dec 13

The DCM reader in ImageMagick before 6.9.4-5 and 7.x before 7.0.1-7 allows remote attackers to have unspecified impact b
CVE-2017-14138 CRITICAL POC
9.8 Sep 04

ImageMagick 7.0.6-5 has a memory leak vulnerability in ReadWEBPImage in coders/webp.c because memory is not freed in cer
CVE-2026-23876 CRITICAL POC
9.8 Jan 20

Heap buffer overflow in ImageMagick's XBM image decoder (ReadXBMImage) lets remote attackers write attacker-controlled d
CVE-2023-34152 CRITICAL POC
9.8 May 30

A vulnerability was found in ImageMagick. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable
CVE-2019-19952 CRITICAL POC
9.8 Dec 24

In ImageMagick 7.0.9-7 Q16, there is a use-after-free in the function MngInfoDiscardObject of coders/png.c, related to R
CVE-2018-14551 CRITICAL POC
9.8 Jul 23

The ReadMATImageV4 function in coders/mat.c in ImageMagick 7.0.8-7 uses an uninitialized variable, leading to memory cor

Same weakness CWE-416 – Use After Free

View all
CVE-2019-0708 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2014-0322 HIGH POC
8.8
CVE-2012-4792 HIGH POC
8.8
CVE-2009-4324 HIGH POC
7.8
CVE-2015-0313 CRITICAL POC
9.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2013-2551 HIGH POC
8.8

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Vendor StatusVendor

SUSE

Severity: Medium
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed
SUSE Linux Enterprise Module for Desktop Applications 15 SP7 Fixed
SUSE Linux Enterprise Module for Development Tools 15 SP7 Fixed
SUSE Linux Enterprise Module for Package Hub 15 SP7 Fixed

Share

CVE-2026-40311 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy