CVE-2026-40310Disclosure(imagemagick / imagemagick)

LOWCVSS 5.5 · MEDIUM

Signal is active with 1 mentions in latest observed window

Immediate actions

Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

ImageMagick is free and open-source software used for editing and manipulating digital images. Versions below both 7.1.2-19 and 6.9.13-44, contain a heap out-of-bounds write in the JP2 encoder with when a user specifies an invalid sampling index. This issue has been fixed in versions 6.9.13-44 and 7.1.2-19.

imagemagick CVEs Back to dashboard

0.0/ 10 priority

Sources & remediation

Patch / fix

https://github.com/ImageMagick/ImageMagick/commit/3d653bea2df085c728a1c8f775808e1e9249dff9

Vendor / third-party advisories

https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-pwg5-6jfc-crvh

Other references

Weakness type (CWE)

CWE-122CWE-787

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

imagemagick

Threat summary

4 mentions across 4 observed days
Momentum state: stable

What's happening

Technical details provided in 4 signals
Disclosure: 3 classified signals
General: 1 classified signal
Peaked 3d ago at 1 mentions (2026-04-13); latest day: 1
4 total mentions across 4 days

Affected systems

Vendors

imagemagick

Products

imagemagick

Deep dive

Activity timeline4 mentions / 4d

Signal classification2 categories

Disclosure

375.0%

General

125.0%

Referenced assets4 URLs

By indicator

Classification over time

Date	Total	Labels

2026-04-13	1	Disclosure1
2026-04-14	1	Disclosure1
2026-04-28	1	Disclosure1
2026-05-18	1	General1

Full discourse4 posts

DailyCVE@dailycve143d
General
🟠 https://dailycve.com/imagemagick-heap-out-of-bounds-write-#cve-2026-40310-moderate-2/ NiceGUI, Unauthenticated Log‑Volume Denial of Service, CVE‑2026‑45554 (moderate)
Post summary
The post lists two CVEs—one for ImageMagick and one for NiceGUI—with basic severity descriptors but provides no evidence of exploits, patches, or active threats.
0000061
206 followersView on X
cvereports@_cvereports163d
Disclosure
CVE-2026-40310: CVE-2026-40310: Heap-Based Out-of-Bounds Write in ImageMagick JP2 Encoder CVE-2026-40310 is a heap-based out-of-bounds write vulnerability within the ImageMagick JPEG 2000 (JP2) encoder. The vulnerability is triggered when the applicat... https://cvereports.com/reports/CVE-2026-40310
Post summary
The text announces CVE-2026-40310 as a heap‑based out‑of‑bounds write vulnerability in ImageMagick’s JP2 encoder, without providing exploit code, active exploitation reports, or mitigation details.
0000023
36 followersView on X
CVE@CVEnew177d
Disclosure
CVE-2026-40310 ImageMagick is free and open-source software used for editing and manipulating digital images. Versions below both 7.1.2-19 and 6.9.13-44, contain a heap out-of-bound… https://www.cve.org/CVERecord?id=CVE-2026-40310
Post summary
The text announces a heap out-of-bound vulnerability in ImageMagick versions older than 7.1.2-19 and 6.9.13-44, providing only the CVE identifier and a brief technical note without any PoC, exploit, or patch details.
0000092
57.2K followersView on X
Vulmon Vulnerability Feed@VulmonFeeds178d
Disclosure
CVE-2026-40310 Heap Out-of-Bounds Write in ImageMagick JP2 Encoder Below 7.1.2-19 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-40310
Post summary
A new heap out-of-bounds write vulnerability (CVE-2026-40310) has been disclosed for ImageMagick JP2 Encoder versions below 7.1.2-19, with no PoC, exploit, or patch details provided.
0000028
4.0K followersView on X

CPE platform detail1 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

1 of 1 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	imagemagick	imagemagick	-	-	-

Explore more

Back to dashboard imagemagick CVEs imagemagick vulnerabilities

What researchers are saying

CVE-2026-40310

DailyCVE@dailycveGeneral

The post lists two CVEs—one for ImageMagick and one for NiceGUI—with basic severity descriptors but provides no evidence of exploits, patches, or active threats.

cvereports@_cvereportsDisclosure

The text announces CVE-2026-40310 as a heap‑based out‑of‑bounds write vulnerability in ImageMagick’s JP2 encoder, without providing exploit code, active exploitation reports, or mitigation details.

CVE@CVEnewDisclosure

The text announces a heap out-of-bound vulnerability in ImageMagick versions older than 7.1.2-19 and 6.9.13-44, providing only the CVE identifier and a brief technical note without any PoC, exploit, or patch details.

Vulmon Vulnerability Feed@VulmonFeedsDisclosure

A new heap out-of-bounds write vulnerability (CVE-2026-40310) has been disclosed for ImageMagick JP2 Encoder versions below 7.1.2-19, with no PoC, exploit, or patch details provided.