CVE-2026-40183 MEDIUM

CVE-2026-40183: ImageMagick: Heap buffer overflow when encoding JXL image with a 16-bit float

Vendor Imagemagick

Product ImageMagick

Weakness CWE-122

Published April 13, 2026

Last update April 14, 2026

View on NVD All CVEs

CVSS base score

5.5/10

Attack vector Local

Attack complexity Low

Privileges required None

User interaction Required

Confidentiality None

Integrity None

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

What the vulnerability does

01Description

ImageMagick is free and open-source software used for editing and manipulating digital images. In versions below 7.1.2-19, the JXL encoder has an heap write overflow when a user specifies that the image should be encoded as 16 bit floats. This issue has been fixed in version 7.1.2-19.

Key dates

02Disclosure timeline

April 13, 2026 CVE published

April 14, 2026 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2026-40183 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/122.html

Related vulnerabilities

04Related CVE

CVE-2024-22453 CVE-2023-21690 Microsoft Protected Extensible Authentication Protocol (PEAP) Remote Code Execution Vulnerability CVE-2026-44819 Microsoft Office Remote Code Execution Vulnerability CVE-2023-21560 Windows Boot Manager Security Feature Bypass Vulnerability CVE-2025-40929 Cpanel::JSON::XS before version 4.40 for Perl has an integer buffer overflow causing a segfault when parsing crafted JSON, enabling denial-of-service attacks or other unspecified impact