ImageMagick is free and open-source software used for editing and manipulating digital images. Versions below 7.1.2-19 and 6.9.13-44 contain a heap use-after-free vulnerability that can cause a crash when reading and printing values from an invalid XMP profile. This issue has been fixed in versions 6.9.13-44 and 7.1.2-19.
{
"cwe_ids": [
"CWE-416",
"CWE-693"
],
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/40xxx/CVE-2026-40311.json",
"cna_assigner": "GitHub_M",
"unresolved_ranges": [
{
"extracted_events": [
{
"fixed": "6.9.13-44"
}
],
"source": "AFFECTED_FIELD"
}
]
}{
"source": "REFERENCES"
}
{
"cpe": "cpe:2.3:a:imagemagick:imagemagick:*:*:*:*:*:*:*:*",
"extracted_events": [
{
"introduced": "7.0.0-0"
},
{
"fixed": "7.1.2-19"
}
],
"source": [
"CPE_RANGE",
"REFERENCES"
]
}
{
"cpe": "cpe:2.3:a:imagemagick:imagemagick:*:*:*:*:*:*:*:*",
"extracted_events": [
{
"introduced": "0"
},
{
"fixed": "6.9.13-44"
}
],
"source": "CPE_RANGE"
}
"2026-08-07T21:27:14Z"
[
{
"id": "CVE-2026-40311-59e3873c",
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"222285193586454422502497687798446690856",
"19943246632884608833905011149576819054",
"31339534516803264423088981577368544162",
"319410082876680929687095919432346315615",
"250832289566746783103566960365310280681",
"3736296424108220982522069587090621128",
"216651295730375137409048303152758773597",
"253295559977672468199915698744289490560",
"310934854621846093613687870151488470475",
"25726517369100251499847279567812551692",
"256118931509070434717697638009185173309",
"300482794561438567768437109510875797701",
"167344543162495842801999615814297249629",
"39778097977646684151442874654260862637",
"27924541040555376087292884645387191963",
"119396722521587149250662503366217341303",
"216651295730375137409048303152758773597",
"253295559977672468199915698744289490560",
"310934854621846093613687870151488470475",
"96674279193901124986065820699575170361",
"73991991774552618303942093769335670121"
]
},
"source": "https://github.com/imagemagick/imagemagick/commit/5facfecf1abb3fed46a08f614dcc43d1e548e20d",
"target": {
"file": "MagickCore/property.c"
}
},
{
"id": "CVE-2026-40311-b9f35db2",
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1",
"digest": {
"length": 1844.0,
"function_hash": "191149215050072404428012550751848131496"
},
"source": "https://github.com/imagemagick/imagemagick/commit/5facfecf1abb3fed46a08f614dcc43d1e548e20d",
"target": {
"function": "GetXMPProperty",
"file": "MagickCore/property.c"
}
}
]
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-40311.json"