CVE-2026-40183: ImageMagick heap buffer overflow in JXL encoder

Executive brief

ImageMagick, a widely used software suite for displaying and converting images, is vulnerable to a memory-related flaw when processing JPEG XL (JXL) images. If a user is tricked into processing a specially crafted image file using 16-bit float encoding, the application may crash or become unresponsive. This could lead to a denial of service, impacting automated image processing workflows or applications that rely on ImageMagick for content rendering.

Technical details

A heap-based buffer overflow (CWE-122) exists in the JXL encoder of ImageMagick. The vulnerability is triggered when a user specifies that an image should be encoded as 16-bit floats, leading to an out-of-bounds write on the heap. The attack vector is local and requires user interaction, such as opening or processing a malicious image file. Successful exploitation primarily impacts system availability by causing a crash (Denial of Service). The issue has been addressed in ImageMagick version 7.1.2-19 and Magick.NET version 14.12.0.

Affected products

• ImageMagick ImageMagick < 7.1.2-19
• dlemstra Magick.NET < 14.12.0

Timeline

• 2026-04-13: disclosed
• 2026-04-13: patched: Fixed in ImageMagick 7.1.2-19 and Magick.NET 14.12.0
• 2026-04-14: advisory

References

• https://api.github.com/users/jakelamberson
• https://github.com/jakelamberson
• https://api.github.com/users/jakelamberson/gists%7B/gist_id%7D
• https://api.github.com/users/jakelamberson/repos
• https://avatars.githubusercontent.com/u/3375663?v=4
• https://api.github.com/users/jakelamberson/events%7B/privacy%7D