CVE-2026-40169

What it actually does

This vulnerability is an out-of-bounds heap write in ImageMagick versions before 7.1.2-19 when processing a crafted image and writing output in YAML or JSON format. The documented impact is an application crash, producing a denial-of-service condition. The CVSS vector indicates local attack vector, low complexity, no privileges required, no user interaction, unchanged scope, no confidentiality or integrity impact, and high availability impact. Although memory corruption flaws can sometimes be investigated for broader exploitation, the published description for this issue supports crash/availability impact rather than confirmed code execution.

Why it matters to the business

Systems, applications, batch jobs, CI/CD workflows, or user-facing services that rely on ImageMagick to convert uploaded or untrusted images to JSON or YAML output may be disrupted by a malformed image. The likely consequence is service instability, failed image-processing pipelines, worker crashes, queue backlogs, or degraded availability. Current exploitation signals are low: EPSS is 0.0018 with no 30-day increase, it is not in CISA KEV, and no public exploit maturity is reported; however, ImageMagick is widely embedded in content-management, media, document, and web-processing stacks, so exposure may exist indirectly through dependent applications.

How an attack unfolds

An attacker first identifies an application, service, script, or workflow that accepts attacker-controlled image files and uses ImageMagick below 7.1.2-19 to emit YAML or JSON output. The attacker then submits a specially crafted image designed to trigger the heap out-of-bounds write during that output-writing path. When ImageMagick processes the file and attempts to serialize output as YAML or JSON, memory is corrupted and the process can crash. In a web service or asynchronous worker model, repeated submissions may cause repeated worker failures, job retries, queue buildup, or denial of service. There is no current evidence from the provided data that this vulnerability is being actively exploited in ransomware campaigns or by named threat actors.

How to fix it

Upgrade ImageMagick to version 7.1.2-19 or later wherever ImageMagick is installed directly or bundled into application containers, appliances, build images, serverless layers, or third-party packages. If packages are supplied by an operating-system vendor, install the vendor security update that backports the fix, even if the displayed version string differs from 7.1.2-19. Where immediate upgrade is not possible, reduce exposure by preventing untrusted users from triggering ImageMagick YAML or JSON output generation, isolating image-processing workers, enforcing job timeouts and memory limits, validating accepted image formats, and running ImageMagick under least privilege in a sandboxed environment. Restart long-running services and workers after patching so they load the corrected binaries and libraries.

How to confirm the fix worked

Confirm installed ImageMagick versions with commands such as `magick -version`, `convert -version`, package-manager queries, container image inventories, and software composition analysis. Verify that all reachable runtime environments use ImageMagick 7.1.2-19 or a vendor-patched equivalent. Review application code and job definitions for ImageMagick invocations that produce JSON or YAML output, such as `json:`, `yaml:`, `.json`, or `.yaml` output targets. After remediation, rerun representative image-processing workflows and confirm they complete without crashes. For exposure validation, test only in a controlled environment with non-malicious regression cases or vendor-provided tests; do not use untrusted proof-of-concept files in production.

Typical attack path

1. Find an exposed feature, API, background job, or automation workflow that accepts image input and invokes ImageMagick.
2. Determine or infer that the workflow can write or convert output to YAML or JSON using an affected ImageMagick version before 7.1.2-19.
3. Submit a crafted image file intended to trigger the out-of-bounds heap write.
4. Cause the ImageMagick process, worker, or parent application component to crash during YAML or JSON output generation.
5. Repeat the submission to sustain denial of service, exhaust worker capacity, or disrupt dependent business workflows.

How to detect it

To assess prior exploitation, review application logs, upload logs, job-queue logs, web server logs, container logs, supervisor logs, and operating-system crash telemetry for ImageMagick crashes associated with image conversion to JSON or YAML. Look for repeated failures of `magick`, `convert`, or ImageMagick-backed worker processes immediately after image uploads or conversion requests. Search for segmentation faults, heap corruption, abort messages, core dumps, worker restarts, and recurring conversion errors involving `.json`, `.yaml`, `json:`, or `yaml:` outputs. In Linux environments, examine `journalctl`, syslog, kernel logs, coredump metadata, container orchestrator restart events, and crash files. In application environments, correlate suspicious image submissions with 5xx responses, job retries, queue backlog spikes, and process exits. There are no provided threat actor names, ransomware associations, or public exploit artifacts, so detection should focus on behavioral evidence of attempted denial of service rather than fixed attacker infrastructure.

• magick
• convert
• ImageMagick
• Segmentation fault
• segfault
• core dumped
• heap corruption
• out of bounds
• out-of-bounds
• Aborted
• SIGSEGV
• SIGABRT
• json:
• yaml:
• .json
• .yaml
• coredumpctl
• /var/lib/systemd/coredump/
• worker exited
• worker crash
• container restart
• CrashLoopBackOff

What your security team should do

• Inventory direct and transitive ImageMagick usage across servers, containers, CI/CD runners, media-processing services, and application dependencies.
• Prioritize patching internet-facing or user-upload-driven image-processing paths before internal-only batch workflows.
• Upgrade to ImageMagick 7.1.2-19 or later, or apply the relevant vendor backport, and restart affected services.
• Temporarily disable or restrict untrusted YAML/JSON output generation through ImageMagick where patching cannot be completed quickly.
• Add resource controls around image-processing workers, including memory limits, CPU limits, execution timeouts, and queue back-pressure.
• Monitor for repeated ImageMagick crashes, abnormal worker restarts, and upload requests followed by failed conversion jobs.
• Because current EPSS, KEV, ransomware, and exploit-maturity signals are low, handle as a normal-priority availability issue unless the service processes untrusted images at scale or is externally exposed.