CVE-2026-40169: ImageMagick heap overflow in YAML and JSON encoders

Executive brief

ImageMagick is a widely used software suite for displaying, converting, and editing image files. A vulnerability in how it handles certain data formats could allow a specially crafted image to cause the application to crash. This could lead to a denial-of-service, impacting the availability of automated image processing workflows.

Technical details

A heap-based buffer overflow (CWE-122) exists in ImageMagick's YAML and JSON encoders. The vulnerability is triggered when the software attempts to write image data to YAML or JSON output formats. An attacker can provide a specially crafted image file that, when processed, results in an out-of-bounds write on the heap. This typically results in a process crash (Denial of Service). The issue is addressed in ImageMagick version 7.1.2-19 and Magick.NET version 14.12.0.

Affected products

• ImageMagick ImageMagick < 7.1.2-19
• dlemstra Magick.NET < 14.12.0

Timeline

• 2026-04-13: advisory: NVD publication date
• 2026-04-14: disclosed: GitHub Advisory published

References

• https://api.github.com/users/zer0matt
• https://github.com/zer0matt
• https://api.github.com/users/zer0matt/gists%7B/gist_id%7D
• https://api.github.com/users/zer0matt/repos
• https://avatars.githubusercontent.com/u/28620328?v=4
• https://api.github.com/users/zer0matt/events%7B/privacy%7D