Heap Use-After-Free Vulnerability in ImageMagick Software
CVE-2026-40311
5.5MEDIUM
What is CVE-2026-40311?
ImageMagick, a popular open-source software for digital image manipulation, has a vulnerability that allows an attacker to exploit a heap use-after-free condition by manipulating invalid XMP profiles. This can lead to crashes within the application, making systems vulnerable to potential data loss or exposure. The issue has been addressed in the latest updates, with users advised to upgrade to versions 6.9.13-44 and 7.1.2-19 to mitigate the risks.
Affected Version(s)
ImageMagick < 7.1.2-19 < 7.1.2-19
ImageMagick < 6.9.13-44 < 6.9.13-44