CVE-2026-40310: 
C# vulnerability analysis and mitigation

CVE-2026-40310 is a heap out-of-bounds write vulnerability in the JP2 (JPEG 2000) encoder of ImageMagick, triggered when a user specifies an invalid sampling index. It affects all ImageMagick versions prior to 6.9.13-44 (6.x branch) and prior to 7.1.2-19 (7.x branch). The vulnerability was disclosed on April 13, 2026, with patches released the same day. It carries a CVSS v3.1 base score of 5.5 (Medium) (GitHub Advisory, Red Hat Bugzilla).

The root cause is improper validation of a user-supplied sampling index in the JP2 encoder (coders/jp2.c), classified as CWE-122 (Heap-based Buffer Overflow), CWE-787 (Out-of-bounds Write), and CWE-1285 (Improper Validation of Specified Index, Position, or Offset in Input). The fix, applied in commit 3d653be, wraps the subsampling_dx and subsampling_dy assignments with MagickMax(..., 1.0) to enforce a minimum valid value, preventing out-of-bounds heap writes when an invalid (e.g., zero or negative) sampling factor is provided (GitHub Commit). Exploitation requires local access and user interaction — specifically, a user must process a maliciously crafted image file with an invalid sampling index through the JP2 encoder (GitHub Advisory).

Successful exploitation results in a denial of service through a crash of the ImageMagick process due to the heap out-of-bounds write. There is no confidentiality or integrity impact — the vulnerability's availability impact is rated High, while confidentiality and integrity impacts are None. The attack scope is unchanged, meaning the impact is confined to the ImageMagick process itself without lateral movement potential (GitHub Advisory, Red Hat Bugzilla).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time. The EPSS score is approximately 0.012% (0.000120), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported (Feedly, GitHub Advisory).

1. Craft a malicious image file: Create or modify a JP2/JPEG 2000 image file that, when processed by ImageMagick, specifies an invalid (e.g., zero or negative) sampling index via the sampling_factor parameter.
2. Deliver the file: Provide the crafted image to a target user or system that will process it with a vulnerable version of ImageMagick (below 6.9.13-44 or 7.1.2-19).
3. Trigger encoding: Cause the target to invoke ImageMagick's JP2 encoder on the malicious file (e.g., via a command like convert malicious.jp2 output.png or through an application that uses ImageMagick for image processing).
4. Achieve denial of service: The invalid sampling index bypasses validation, causing a heap out-of-bounds write in coders/jp2.c, which crashes the ImageMagick process (GitHub Commit, GitHub Advisory).

• Process: Unexpected crashes or segmentation faults in the ImageMagick process (convert, magick, or application processes embedding ImageMagick) when processing JP2/JPEG 2000 files.
• Logs: Application or system logs showing ImageMagick process termination with signals such as SIGSEGV or SIGABRT, particularly when handling JP2 image files.
• File System: Presence of suspicious or unexpected JP2 image files in directories processed by ImageMagick, especially files with unusual or minimal content.
• System: Core dump files generated by ImageMagick crashes, potentially located in the working directory or system core dump path.

Update ImageMagick to version 6.9.13-44 or later (6.x branch) or 7.1.2-19 or later (7.x branch). For .NET users, Magick.NET 14.12.0 incorporates the fix. As a workaround, restrict user access to JP2 encoding functionality if not required, and implement input validation to prevent processing of untrusted image files. Distribution-specific packages have been updated for openSUSE, Debian, and Amazon Linux 2/2023 (GitHub Advisory, Magick.NET Release, Red Hat Bugzilla).

The vulnerability was reported by researcher jakelamberson and published by ImageMagick maintainer dlemstra via GitHub Security Advisories on April 13, 2026. Red Hat tracked the issue as medium severity in their Bugzilla system. Downstream Linux distributions including openSUSE, Debian, and Amazon Linux issued security updates shortly after disclosure. No significant broader media coverage or notable community controversy has been observed (GitHub Advisory, Red Hat Bugzilla).