CVE-2026-40311: ImageMagick heap use-after-free in XMP profile processing

CVE-2026-40311 · Severity: medium · CVSS 5.5 · Published 2026-04-14

ImageMagick is a widely used software suite for editing and manipulating digital images. A vulnerability has been identified where processing a specially crafted image with an invalid XMP metadata profile can cause the application to crash. This could lead to a denial-of-service condition for services or automated workflows that process user-supplied images.

Technologies: Dlemstra Magick.NET, Magick.NET-Q16-AnyCPU (NuGet), Magick.NET-Q16-arm64 (NuGet), Magick.NET-Q16-HDRI-AnyCPU (NuGet), Magick.NET-Q16-HDRI-arm64 (NuGet), Magick.NET-Q16-HDRI-OpenMP-arm64 (NuGet), Magick.NET-Q16-HDRI-x64 (NuGet), Magick.NET-Q16-HDRI-x86 (NuGet), Magick.NET-Q16-OpenMP-arm64 (NuGet), Magick.NET-Q16-OpenMP-x64 (NuGet), Magick.NET-Q16-x64 (NuGet), Magick.NET-Q16-x86 (NuGet), Magick.NET-Q8-AnyCPU (NuGet), Magick.NET-Q8-arm64 (NuGet), Magick.NET-Q8-OpenMP-arm64 (NuGet), Magick.NET-Q8-x64 (NuGet), Magick.NET-Q8-x86 (NuGet). Vendors: Dlemstra, NuGet.

Quick answers

Is CVE-2026-40311 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-40311 being exploited in the wild.
How severe is CVE-2026-40311?
Medium severity, with a CVSS score of 5.5, published 14 April 2026.
Which products and versions are affected?
Dlemstra Magick.NET < 14.12.0; Magick.NET-Q16-AnyCPU (NuGet) < 14.12.0, ECOSYSTEM:introduced=0,fixed=14.12.0; Magick.NET-Q16-arm64 (NuGet) < 14.12.0, ECOSYSTEM:introduced=0,fixed=14.12.0; Magick.NET-Q16-HDRI-AnyCPU (NuGet) < 14.12.0, ECOSYSTEM:introduced=0,fixed=14.12.0; and 13 more.
Is there a fix for CVE-2026-40311?
Yes. Magick.NET-Q16-AnyCPU (NuGet): upgrade to 14.12.0 or later; Magick.NET-Q16-arm64 (NuGet): upgrade to 14.12.0 or later; Magick.NET-Q16-HDRI-AnyCPU (NuGet): upgrade to 14.12.0 or later; Magick.NET-Q16-HDRI-arm64 (NuGet): upgrade to 14.12.0 or later; Magick.NET-Q16-HDRI-OpenMP-arm64 (NuGet): upgrade to 14.12.0 or later; Magick.NET-Q16-HDRI-x64 (NuGet): upgrade to 14.12.0 or later; Magick.NET-Q16-HDRI-x86 (NuGet): upgrade to 14.12.0 or later; Magick.NET-Q16-OpenMP-arm64 (NuGet): upgrade to 14.12.0 or later; Magick.NET-Q16-OpenMP-x64 (NuGet): upgrade to 14.12.0 or later; Magick.NET-Q16-x64 (NuGet): upgrade to 14.12.0 or later; Magick.NET-Q16-x86 (NuGet): upgrade to 14.12.0 or later; Magick.NET-Q8-AnyCPU (NuGet): upgrade to 14.12.0 or later; Magick.NET-Q8-arm64 (NuGet): upgrade to 14.12.0 or later; Magick.NET-Q8-OpenMP-arm64 (NuGet): upgrade to 14.12.0 or later; Magick.NET-Q8-x64 (NuGet): upgrade to 14.12.0 or later; Magick.NET-Q8-x86 (NuGet): upgrade to 14.12.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-40311 attacked?
It is attacked with local access, in a software library.
Am I affected by CVE-2026-40311?
Check whether you run Dlemstra Magick.NET, Magick.NET-Q16-AnyCPU (NuGet), Magick.NET-Q16-arm64 (NuGet) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • Magick.NET-Q16-AnyCPU (NuGet): upgrade to 14.12.0 or later
    dotnet add package Magick.NET-Q16-AnyCPU --version 14.12.0
  • Magick.NET-Q16-arm64 (NuGet): upgrade to 14.12.0 or later
    dotnet add package Magick.NET-Q16-arm64 --version 14.12.0
  • Magick.NET-Q16-HDRI-AnyCPU (NuGet): upgrade to 14.12.0 or later
    dotnet add package Magick.NET-Q16-HDRI-AnyCPU --version 14.12.0
  • Magick.NET-Q16-HDRI-arm64 (NuGet): upgrade to 14.12.0 or later
    dotnet add package Magick.NET-Q16-HDRI-arm64 --version 14.12.0
  • Magick.NET-Q16-HDRI-OpenMP-arm64 (NuGet): upgrade to 14.12.0 or later
    dotnet add package Magick.NET-Q16-HDRI-OpenMP-arm64 --version 14.12.0
  • Magick.NET-Q16-HDRI-x64 (NuGet): upgrade to 14.12.0 or later
    dotnet add package Magick.NET-Q16-HDRI-x64 --version 14.12.0
  • Magick.NET-Q16-HDRI-x86 (NuGet): upgrade to 14.12.0 or later
    dotnet add package Magick.NET-Q16-HDRI-x86 --version 14.12.0
  • Magick.NET-Q16-OpenMP-arm64 (NuGet): upgrade to 14.12.0 or later
    dotnet add package Magick.NET-Q16-OpenMP-arm64 --version 14.12.0
  • Magick.NET-Q16-OpenMP-x64 (NuGet): upgrade to 14.12.0 or later
    dotnet add package Magick.NET-Q16-OpenMP-x64 --version 14.12.0
  • Magick.NET-Q16-x64 (NuGet): upgrade to 14.12.0 or later
    dotnet add package Magick.NET-Q16-x64 --version 14.12.0
  • Magick.NET-Q16-x86 (NuGet): upgrade to 14.12.0 or later
    dotnet add package Magick.NET-Q16-x86 --version 14.12.0
  • Magick.NET-Q8-AnyCPU (NuGet): upgrade to 14.12.0 or later
    dotnet add package Magick.NET-Q8-AnyCPU --version 14.12.0
  • Magick.NET-Q8-arm64 (NuGet): upgrade to 14.12.0 or later
    dotnet add package Magick.NET-Q8-arm64 --version 14.12.0
  • Magick.NET-Q8-OpenMP-arm64 (NuGet): upgrade to 14.12.0 or later
    dotnet add package Magick.NET-Q8-OpenMP-arm64 --version 14.12.0
  • Magick.NET-Q8-x64 (NuGet): upgrade to 14.12.0 or later
    dotnet add package Magick.NET-Q8-x64 --version 14.12.0
  • Magick.NET-Q8-x86 (NuGet): upgrade to 14.12.0 or later
    dotnet add package Magick.NET-Q8-x86 --version 14.12.0

Technical details

A heap use-after-free vulnerability exists in ImageMagick's MagickCore/property.c component. The issue occurs when the software attempts to read and subsequently print values from an invalid XMP (Extensible Metadata Platform) profile. An attacker can exploit this by providing a malformed image file that, when processed by a vulnerable version of ImageMagick or its wrappers like Magick.NET, triggers the use-after-free condition. This results in memory corruption and a crash (denial of service). The vulnerability is addressed in ImageMagick versions 7.1.2-19 and 6.9.13-44, and Magick.NET version 14.12.0.

Affected products

  • ImageMagick ImageMagick < 7.1.2-19, < 6.9.13-44
  • dlemstra Magick.NET < 14.12.0

Identifiers

  • CVE-2026-40311
  • GHSA-r83h-crwp-3vm7

Timeline

  • 2026-04-12: patched: ImageMagick 7.1.2-19 released
  • 2026-04-13: disclosed: NVD publication date
  • 2026-04-14: advisory: GitHub Advisory published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.