Fluid Attacks Database

Description

ImageMagick has a heap buffer overflow when encoding JXL image with a 16-bit float The JXL encoder has an heap write overflow when a user specifies that the image should be encoded as 16 bit floats.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Package	Affected version	Patched versions
debian 14	imagemagick	=8:7.1.1.43+dfsg1-1 \|\| =8:7.1.1.46+dfsg1-1 \|\| =8:7.1.1.47+dfsg1-1 \|\| =8:7.1.1.47+dfsg1-2 \|\| =8:7.1.2.1+dfsg1-1 \|\| =8:7.1.2.12+dfsg1-1 \|\| =8:7.1.2.13+dfsg1-1 \|\| =8:7.1.2.15+dfsg1-1 \|\| =8:7.1.2.15+dfsg1-2 \|\| =8:7.1.2.16+dfsg1-1 \|\| =8:7.1.2.18+dfsg1-1 \|\| =8:7.1.2.3+dfsg1-1 \|\| =8:7.1.2.7+dfsg1-1 \|\| =8:7.1.2.8+dfsg1-1 \|\| >=0 <8:7.1.2.19+dfsg1-1	8:7.1.2.19+dfsg1-1
nuget	magick.net-q16-hdri-x86	>=0 <14.12.0	14.12.0
rpm rhel7	ImageMagick	-	-
debian 13	imagemagick	=8:7.1.1.43+dfsg1-1 \|\| =8:7.1.1.43+dfsg1-1+deb13u1 \|\| =8:7.1.1.43+dfsg1-1+deb13u2 \|\| =8:7.1.1.43+dfsg1-1+deb13u3 \|\| =8:7.1.1.43+dfsg1-1+deb13u4 \|\| =8:7.1.1.43+dfsg1-1+deb13u5 \|\| =8:7.1.1.43+dfsg1-1+deb13u6 \|\| =8:7.1.1.43+dfsg1-1+deb13u7 \|\| >=0 <8:7.1.1.43+dfsg1-1+deb13u8	8:7.1.1.43+dfsg1-1+deb13u8
nuget	magick.net-q16-hdri-x64	>=0 <14.12.0	14.12.0
rpm rhel6	ImageMagick	-	-
nuget	magick.net-q16-anycpu	>=0 <14.12.0	14.12.0
nuget	magick.net-q16-hdri-openmp-arm64	>=0 <14.12.0	14.12.0
nuget	magick.net-q16-openmp-x64	>=0 <14.12.0	14.12.0
nuget	magick.net-q16-arm64	>=0 <14.12.0	14.12.0

1-10 of 21

Aliases

1. CVE-2026-401832. NVD-2026-401833. OSV-DEBIAN-2026-401834. OSV-2026-401835. GHSA-jvgr-9ph5-m8v46. GCVE-2026-401837. SECURITY-TRACKER-CVE-2026-40183

References

1. https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-jvgr-9ph5-m8v42. https://github.com/ImageMagick/ImageMagick/commit/1c7767fc5f822c6edc104c1220d523e96fa20b5a3. https://github.com/ImageMagick/ImageMagick/releases/tag/7.1.2-194. https://github.com/dlemstra/Magick.NET/releases/tag/14.12.0