CVE-2026-40311

What it actually does

CVE-2026-40311 is a heap use-after-free in ImageMagick when processing an invalid XMP profile. A crafted image or metadata-bearing file can cause ImageMagick to read or print values from freed heap memory during parsing, resulting in process instability and likely application crash. Based on the provided CVSS vector, the known impact is availability loss only: no confirmed confidentiality or integrity impact, and exploitation requires user interaction or an application workflow that processes attacker-supplied files locally.

Why it matters to the business

Organizations that use ImageMagick in image upload, document conversion, thumbnailing, media processing, or automated content pipelines could experience denial of service if malicious files are processed. The most likely consequence is disruption of services that depend on image conversion or metadata handling, such as failed uploads, broken preview generation, queue backlogs, worker crashes, or degraded application availability. Current risk is moderated by the low EPSS score, no known public exploit maturity, and no CISA KEV listing, but ImageMagick is widely embedded in applications and downstream packages, so exposure may exist indirectly through third-party software or container images.

How an attack unfolds

An attacker prepares an image or image-like file containing a malformed XMP profile that triggers the use-after-free condition in affected ImageMagick versions below 7.1.2-19 or 6.9.13-44. The attacker then causes a vulnerable ImageMagick invocation to process the file, typically by uploading it to an application that generates thumbnails, extracts metadata, converts formats, validates images, or prints image profile values. When the vulnerable parser reads the invalid XMP profile, it accesses heap memory after it has been freed. The expected result is a crash of the ImageMagick process or the application component embedding it, producing a denial-of-service condition. There is currently no indication from the supplied intelligence that this vulnerability is being exploited by named threat actors, ransomware campaigns, or broadly available exploit code.

How to fix it

Upgrade ImageMagick to a fixed release: version 7.1.2-19 or later for the 7.x branch, or version 6.9.13-44 or later for the 6.x branch. Because ImageMagick is frequently bundled into operating system packages, containers, language wrappers, and third-party applications, inventory both direct installations and transitive use through packages such as application image-processing libraries. Rebuild and redeploy containers or serverless artifacts that include vulnerable ImageMagick binaries or libraries. If immediate upgrade is not possible, reduce exposure by restricting untrusted image uploads, disabling or stripping XMP/profile processing where feasible, enforcing file size and type limits, isolating image conversion workers, applying process timeouts and automatic restarts, and running ImageMagick under least-privilege sandboxing such as containers, seccomp/AppArmor/SELinux profiles, or dedicated low-privilege service accounts.

How to confirm the fix worked

Confirm installed ImageMagick versions with commands such as `magick -version`, `convert -version`, package-manager queries, container image scans, and software composition analysis. Verify that all deployed instances report ImageMagick 7.1.2-19 or later, or 6.9.13-44 or later, including worker nodes, CI/CD images, background processors, and embedded application runtimes. Validate that applications processing untrusted files have been restarted or redeployed after upgrade. If safe test assets are available from the vendor or internal security team, process a non-malicious regression sample in a controlled environment and confirm that the process no longer crashes. Also confirm compensating controls by testing that unsupported file types, oversized uploads, and metadata-heavy files are rejected or handled in isolated workers.

Typical attack path

1. Identify an application, service, script, or processing pipeline that accepts image files and uses ImageMagick for metadata parsing, conversion, or thumbnail generation.
2. Craft or obtain a file with an invalid XMP profile designed to trigger the heap use-after-free condition.
3. Submit the file through an upload form, API endpoint, email ingestion flow, shared folder, batch job, or other path that causes ImageMagick to process it.
4. Wait for the vulnerable ImageMagick process to read or print values from the malformed XMP profile.
5. Cause the ImageMagick process, worker, or dependent service to crash, potentially disrupting image-processing functionality or consuming operational capacity through repeated submissions.

How to detect it

To determine whether exploitation may already have occurred, review application logs, upload logs, image-processing worker logs, job queue failure records, crash dumps, system journals, container restart events, and endpoint telemetry for crashes or abnormal terminations of ImageMagick commands shortly after processing user-supplied files. Focus on workflows that call `magick`, `convert`, `identify`, `mogrify`, or libraries wrapping ImageMagick. Look for repeated crashes tied to the same source address, account, upload path, filename, MIME type, or job payload, especially where files contain XMP metadata. On Linux, review `journalctl`, syslog, kernel logs, coredump records, container orchestrator events, and supervisor logs for segmentation faults, aborts, or worker restarts involving ImageMagick. In application logs, correlate HTTP 5xx responses, failed thumbnail generation, metadata extraction errors, and job retries with uploaded files containing `<x:xmpmeta`, `xpacket`, or Adobe XMP profile markers. Because no unique exploit string is provided, detection should emphasize behavioral evidence: ImageMagick process crashes during profile parsing, repeated denial-of-service attempts, and suspicious metadata-heavy images.

• magick
• convert
• identify
• mogrify
• Segmentation fault
• core dumped
• use-after-free
• XMP profile
• invalid XMP profile
• <x:xmpmeta
• <?xpacket begin=
• <?xpacket end=
• profile.xmp
• ImageMagick
• MagickCore
• MagickWand

What your security team should do

• Inventory ImageMagick usage across servers, containers, developer images, CI/CD jobs, and third-party applications, prioritizing internet-facing upload and conversion workflows.
• Patch all affected installations to ImageMagick 7.1.2-19 or later, or 6.9.13-44 or later, and rebuild dependent containers or application artifacts.
• Prioritize remediation for services that automatically process untrusted images, documents, email attachments, or user-generated media.
• Apply sandboxing, resource limits, file validation, and worker isolation around ImageMagick even after patching, because media parsers are frequent denial-of-service and memory-safety targets.
• Add monitoring for repeated ImageMagick crashes, abnormal exits, worker restarts, and suspicious files containing malformed or unusually large XMP metadata.
• Review recent upload, conversion, and crash logs for signs of repeated failures associated with files containing XMP profiles.
• Track vendor and distribution advisories, because fixed package versions may differ across operating system maintainers even when the upstream fixed versions are 7.1.2-19 and 6.9.13-44.