CVE-2026-40312: ImageMagick off-by-one error in MSL decoder

Executive brief

ImageMagick, a widely used suite for displaying and converting images, is vulnerable to a flaw when processing specific script files. An attacker can provide a specially crafted Magick Scripting Language (MSL) file that causes the application to crash. This can lead to a denial-of-service, interrupting business operations that rely on automated image processing.

Technical details

An off-by-one error (CWE-193) exists in the Magick Scripting Language (MSL) decoder of ImageMagick. The vulnerability is triggered when the library attempts to read and parse a maliciously crafted .msl file. This is a local attack vector requiring no special privileges or user interaction beyond the application attempting to process the file. Successful exploitation results in a memory corruption that leads to an application crash (Denial of Service). The issue has been addressed in ImageMagick version 7.1.2-19 and Magick.NET version 14.12.0.

Affected products

• ImageMagick ImageMagick < 7.1.2-19
• dlemstra Magick.NET < 14.12.0

Timeline

• 2026-04-13: advisory: NVD publication date
• 2026-04-14: disclosed: GitHub Advisory published
• 2026-04-14: patched: GitHub Advisory reviewed and updated with patch information

References

• https://api.github.com/users/COCOP1l0t
• https://github.com/COCOP1l0t
• https://api.github.com/users/COCOP1l0t/gists%7B/gist_id%7D
• https://api.github.com/users/COCOP1l0t/repos
• https://avatars.githubusercontent.com/u/260065109?v=4
• https://api.github.com/users/COCOP1l0t/events%7B/privacy%7D