Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
6.2
CVE-2026-40169: ImageMagick can crash with specially crafted images
CVE-2026-40169 · published 6 months ago
Summary
Versions of ImageMagick older than 7.1.2-19 may crash when they try to write YAML or JSON output from a maliciously crafted image. The problem could cause the application to stop working, potentially disrupting any workflow that relies on image processing. Upgrade ImageMagick to version 7.1.2-19 or later to eliminate the risk.
What to do
- Update dirk lemstra magick.net-q8-anycpu to version 14.12.0.
- Update dirk lemstra magick.net-q16-hdri-anycpu to version 14.12.0.
- Update dirk lemstra magick.net-q16-anycpu to version 14.12.0.
- Update dirk lemstra magick.net-q8-x86 to version 14.12.0.
- Update dirk lemstra magick.net-q16-hdri-arm64 to version 14.12.0.
- Update dirk lemstra magick.net-q16-hdri-openmp-arm64 to version 14.12.0.
- Update dirk lemstra magick.net-q16-openmp-arm64 to version 14.12.0.
- Update dirk lemstra magick.net-q16-arm64 to version 14.12.0.
- Update dirk lemstra magick.net-q16-openmp-x64 to version 14.12.0.
- Update dirk lemstra magick.net-q8-openmp-arm64 to version 14.12.0.
- Update dirk lemstra magick.net-q16-hdri-x64 to version 14.12.0.
- Update dirk lemstra magick.net-q16-x86 to version 14.12.0.
- Update dirk lemstra magick.net-q16-hdri-x86 to version 14.12.0.
- Update dirk lemstra magick.net-q8-arm64 to version 14.12.0.
- Update dirk lemstra magick.net-q8-openmp-x64 to version 14.12.0.
- Update dirk lemstra magick.net-q16-x64 to version 14.12.0.
- Update dirk lemstra magick.net-q8-x64 to version 14.12.0.
- Update debian imagemagick to version 8:7.1.1.43+dfsg1-1+deb13u8.
- Update debian imagemagick to version 8:7.1.2.19+dfsg1-1.
- Update imagemagick imagemagick to version 7.1.2-19 or later.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Debian:13 | debian | imagemagick |
< 8:7.1.1.43+dfsg1-1+deb13u8 Fix: upgrade to 8:7.1.1.43+dfsg1-1+deb13u8
|
| Debian:14 | debian | imagemagick |
< 8:7.1.2.19+dfsg1-1 Fix: upgrade to 8:7.1.2.19+dfsg1-1
|
| nuget | dirk lemstra | magick.net-q8-anycpu |
< 14.12.0 Fix: upgrade to 14.12.0
|
| nuget | dirk lemstra | magick.net-q16-hdri-anycpu |
< 14.12.0 Fix: upgrade to 14.12.0
|
| nuget | dirk lemstra | magick.net-q16-anycpu |
< 14.12.0 Fix: upgrade to 14.12.0
|
| nuget | dirk lemstra | magick.net-q8-x86 |
< 14.12.0 Fix: upgrade to 14.12.0
|
| nuget | dirk lemstra | magick.net-q16-hdri-arm64 |
< 14.12.0 Fix: upgrade to 14.12.0
|
| nuget | dirk lemstra | magick.net-q16-hdri-openmp-arm64 |
< 14.12.0 Fix: upgrade to 14.12.0
|
| nuget | dirk lemstra | magick.net-q16-openmp-arm64 |
< 14.12.0 Fix: upgrade to 14.12.0
|
| nuget | dirk lemstra | magick.net-q16-arm64 |
< 14.12.0 Fix: upgrade to 14.12.0
|
| nuget | dirk lemstra | magick.net-q16-openmp-x64 |
< 14.12.0 Fix: upgrade to 14.12.0
|
| nuget | dirk lemstra | magick.net-q8-openmp-arm64 |
< 14.12.0 Fix: upgrade to 14.12.0
|
| nuget | dirk lemstra | magick.net-q16-hdri-x64 |
< 14.12.0 Fix: upgrade to 14.12.0
|
| nuget | dirk lemstra | magick.net-q16-x86 |
< 14.12.0 Fix: upgrade to 14.12.0
|
| nuget | dirk lemstra | magick.net-q16-hdri-x86 |
< 14.12.0 Fix: upgrade to 14.12.0
|
| nuget | dirk lemstra | magick.net-q8-arm64 |
< 14.12.0 Fix: upgrade to 14.12.0
|
| nuget | dirk lemstra | magick.net-q8-openmp-x64 |
< 14.12.0 Fix: upgrade to 14.12.0
|
| nuget | dirk lemstra | magick.net-q16-x64 |
< 14.12.0 Fix: upgrade to 14.12.0
|
| nuget | dirk lemstra | magick.net-q8-x64 |
< 14.12.0 Fix: upgrade to 14.12.0
|
| – | imagemagick | imagemagick |
< 7.1.2-19 cpe:2.3:a:imagemagick:imagemagick:*:*:*:*:*:*:*:* |
| Ubuntu:Pro:14.04:LTS | canonical | imagemagick | All versions |
Original advisory text
ImageMagick: Heap buffer overflow (WRITE) in the YAML and JSON encoders
ImageMagick is free and open-source software used for editing and manipulating digital images. In versions below 7.1.2-19, a crafted image could result in an out of bounds heap write when writing a yaml or json output, resulting in a crash. This issue has been fixed in version 7.1.2-19.
References
- https://github.com/dlemstra/Magick.NET/releases/tag/14.12.0 URL
- https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-5592-p365-24... Vendor Advisory
- https://github.com/ImageMagick/ImageMagick/commit/f86452a8aea37bf2b4bd36127f836d... Patch
- https://security-tracker.debian.org/tracker/CVE-2026-40169 Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-40169 Vendor Advisory
- https://github.com/advisories/GHSA-5592-p365-24xh
- https://github.com/ImageMagick/ImageMagick Product
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/40xxx/CVE-2026-40169... Vendor Advisory
- https://ubuntu.com/security/CVE-2026-40169 Third Party Advisory
- https://www.cve.org/CVERecord?id=CVE-2026-40169 Third Party Advisory
- https://github.com/ImageMagick/ImageMagick/releases/tag/7.1.2-19 URL
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Type
CWE-122Heap-based Buffer Overflow
CWE-787Out-of-bounds Write
Timeline
Published13 Apr 2026
Updated3 Nov 2026
First seen13 Apr 2026
Sources
CVE-2026-40169 · NVD
GHSA-5592-p365-24xh · GHSA
GHSA-5592-p365-24xh · OSV
CVE-2026-40169 · OSV
DEBIAN-CVE-2026-40169 · OSV
UBUNTU-CVE-2026-40169 · OSV
Track software like this
Free during beta