CVE-2026-40311: 
C# vulnerability analysis and mitigation

CVE-2026-40311 is a heap use-after-free vulnerability in ImageMagick that can cause an application crash when reading and printing values from an invalid XMP profile embedded in image files. It affects ImageMagick versions below 7.1.2-19 (7.x branch) and below 6.9.13-44 (6.x branch). The vulnerability was disclosed on April 13, 2026, and was reported by researcher 1chig0. It carries a CVSS v3.1 base score of 5.5 (Medium) (GitHub Advisory, Red Hat Bugzilla).

The root cause is a CWE-416 (Use After Free) condition in MagickCore/property.c, specifically within the GetXMPProperty function. When processing an invalid XMP profile, the code previously reused a freed xmp_namespace pointer when adding values to the splay tree and then printing them, leading to a heap use-after-free. The fix introduces proper memory management by allocating a new property string, validating its length and content before inserting into the splay tree, and explicitly destroying the string afterward via DestroyString(). Exploitation requires a user to open or process a specially crafted image file containing a malformed XMP profile, making user interaction a prerequisite (GitHub Advisory, Fix Commit). Additional associated weaknesses include CWE-693 (Protection Mechanism Failure) and CWE-825 (Expired Pointer Dereference).

Successful exploitation results in a denial of service (DoS) through an application crash, impacting availability with no effect on confidentiality or integrity. Any system or service that processes untrusted image files using a vulnerable version of ImageMagick — such as web applications, media pipelines, or document converters — is at risk of being crashed by a maliciously crafted image. There is no evidence of code execution potential; the impact is limited to availability of the image processing component (GitHub Advisory, Red Hat Bugzilla).

There is no public proof-of-concept exploit code and no evidence of in-the-wild exploitation at this time (GitHub Advisory). The vulnerability has a low EPSS score of approximately 0.015%, reflecting a low probability of near-term exploitation. The attack vector is local and requires user interaction (opening a malicious image), which further limits exploitability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Nessus detection plugins (IDs 310088, 310237, 310242, 310224, 311220, 311488, 311814) are available for scanning.

1. Craft a malicious image: Create an image file (e.g., JPEG, TIFF, or PNG) containing a specially crafted, invalid XMP profile designed to trigger the use-after-free condition in GetXMPProperty within MagickCore/property.c.
2. Deliver the image: Distribute the malicious image to a target system where a vulnerable version of ImageMagick (< 7.1.2-19 or < 6.9.13-44) is in use — for example, by uploading it to a web application that processes user-supplied images, or by social engineering a user into opening it.
3. Trigger processing: Cause ImageMagick to process the image, either through direct invocation (e.g., convert malicious.jpg output.png) or via an application that calls ImageMagick internally.
4. Achieve DoS: When ImageMagick reads and attempts to print the invalid XMP profile values, the heap use-after-free is triggered, causing the process to crash and resulting in a denial of service (GitHub Advisory, Fix Commit).

• Process: Unexpected crash or segmentation fault of the ImageMagick process (convert, magick, or application embedding libMagickCore) when processing a specific image file.
• Logs: Application error logs showing Segmentation fault, heap-use-after-free, or SIGABRT signals originating from MagickCore/property.c or the GetXMPProperty function.
• File System: Presence of suspicious image files with anomalous or oversized XMP metadata blocks in directories processed by ImageMagick.
• System: Core dump files generated by a crashed ImageMagick process, potentially referencing property.c in the stack trace.

Upgrade ImageMagick to version 7.1.2-19 (7.x branch) or 6.9.13-44 (6.x branch), which contain the fix (GitHub Release, GitHub Advisory). Users of the Magick.NET .NET wrapper should upgrade to version 14.12.0 or later (Magick.NET Release). As interim workarounds for systems that cannot be immediately patched: restrict processing of untrusted image files, implement input validation to reject images with suspicious or malformed XMP profiles, and run ImageMagick in a sandboxed or containerized environment to limit the blast radius of any crash. Distribution-specific packages for openSUSE, Amazon Linux 2, Amazon Linux 2023, and Debian have also been updated.

The vulnerability was reported by security researcher 1chig0 and disclosed via the ImageMagick GitHub Security Advisory program (GitHub Advisory). Red Hat tracked the issue via Bugzilla (Bug 2458051) and rated it medium severity (Red Hat Bugzilla). Multiple Linux distributions including openSUSE, Debian, and Amazon Linux have issued security updates. Community reaction has been routine given the moderate severity and DoS-only impact.