Patchwire CVEs, their patch status, and feeds to follow them

CVE-2026-40183

Fixed in a distro release EPSS <1%CVSS 5.5

ImageMagick is free and open-source software used for editing and manipulating digital images. In versions below 7.1.2-19, the JXL encoder has an heap write overflow when a user specifies that the image should be encoded as 16 bit floats. This issue has been fixed in version 7.1.2-19.

Published 2026-04-13 · CVE record · OSV

Products: imagemagick

Fixed upstream

EcosystemPackageFixed in
NuGetMagick.NET-Q16-AnyCPU14.12.0
NuGetMagick.NET-Q16-HDRI-AnyCPU14.12.0
NuGetMagick.NET-Q16-HDRI-OpenMP-arm6414.12.0
NuGetMagick.NET-Q16-HDRI-arm6414.12.0
NuGetMagick.NET-Q16-HDRI-x6414.12.0
NuGetMagick.NET-Q16-HDRI-x8614.12.0
NuGetMagick.NET-Q16-OpenMP-arm6414.12.0
NuGetMagick.NET-Q16-OpenMP-x6414.12.0
NuGetMagick.NET-Q16-arm6414.12.0
NuGetMagick.NET-Q16-x6414.12.0
NuGetMagick.NET-Q16-x8614.12.0
NuGetMagick.NET-Q8-AnyCPU14.12.0
NuGetMagick.NET-Q8-OpenMP-arm6414.12.0
NuGetMagick.NET-Q8-OpenMP-x6414.12.0
NuGetMagick.NET-Q8-arm6414.12.0
NuGetMagick.NET-Q8-x6414.12.0
NuGetMagick.NET-Q8-x8614.12.0

Distro releases

ReleasePackageFixed in
Chainguardimagemagick-6no fix
Chainguardimagemagick-6-dev6.9.13.46-r1
Chainguardimagemagick-6-doc6.9.13.46-r1
Chainguardimagemagick-6-static6.9.13.46-r1
Debian 13imagemagick8:7.1.1.43+dfsg1-1+deb13u8
Debian 14imagemagick8:7.1.2.19+dfsg1-1
SUSE Linux Enterprise Module for Desktop Applications 15 SP7ImageMagick7.1.1.43-150700.3.47.1
SUSE Linux Enterprise Module for Development Tools 15 SP7ImageMagick7.1.1.43-150700.3.47.1
SUSE Linux Enterprise Server 15 SP6-LTSSImageMagick7.1.1.21-150600.3.55.1
SUSE Linux Enterprise Server for SAP Applications 15 SP6ImageMagick7.1.1.21-150600.3.55.1
Ubuntu 25.10imagemagickno fix
Ubuntu 26.10imagemagickno fix
Ubuntu Pro 26.04 LTSimagemagickno fix
openSUSE Leap 16.0ImageMagick7.1.2.0-160000.8.1
openSUSE TumbleweedImageMagick7.1.2.19-2.1