Skip to main content

ImageMagick CVE-2026-40312

| EUVDEUVD-2026-22132 MEDIUM
Off-by-one Error (CWE-193)
2026-04-13 GitHub_M GHSA-5xg3-585r-9jh5
Denial Of Service Imagemagick
6.2
CVSS 3.1 · GitHub Advisory
Share

Severity by source

GitHub Advisory PRIMARY
6.2 MEDIUM
AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
vuln.today AI
6.2 MEDIUM

Local file parse by any user crashes the process; no auth, interaction, or scope change; only availability is impacted.

3.1 AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
4.0 AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
MEDIUM
qualitative
Red Hat
6.2 MEDIUM
qualitative

Primary rating from GitHub Advisory.

CVSS VectorGitHub Advisory

Attack Vector
Local
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

5
Source Code Evidence Fetched
Jul 24, 2026 - 07:50 vuln.today
Analysis Generated
Jul 24, 2026 - 07:50 vuln.today
Patch released
Apr 14, 2026 - 20:30 nvd
Patch available
EUVD ID Assigned
Apr 13, 2026 - 22:00 euvd
EUVD-2026-22132
CVE Published
Apr 13, 2026 - 21:43 nvd
MEDIUM 6.2

DescriptionGitHub Advisory

ImageMagick is free and open-source software used for editing and manipulating digital images. In versions below 7.1.2-19, an off by one error in the MSL decoder could result in a crash when a malicous MSL file is read. This issue has been fixed in version 7.1.2-19.

AnalysisAI

Denial of service in ImageMagick's MSL decoder (versions below 7.1.2-19) allows any user who can supply a crafted MSL file to crash the ImageMagick process via an off-by-one out-of-bounds array access in coders/msl.c. The root cause is a single incorrect array index in MSLPushImage that writes one element beyond the allocated group_info array. No active exploitation is confirmed (not in CISA KEV), EPSS sits at 0.01% (2nd percentile), and SSVC assessment reports exploitation status as none - making this a low-urgency patch despite the moderate CVSS base score of 6.2.

Technical ContextAI

The vulnerability resides in the MSL (Magick Scripting Language) decoder within coders/msl.c, specifically the MSLPushImage function. MSL is an XML-based scripting format used by ImageMagick for batch image manipulation. The off-by-one error (CWE-193) manifests as incorrect array indexing: the original code increments numImages on msl_info->group_info[msl_info->number_groups], accessing one element past the end of the array, when the correct index is number_groups-1. The fix in commit 2a06c7be3bba3326caf8b7a8d1fa2e0d4b88998d is a single character change. The affected CPE is cpe:2.3:a:imagemagick:imagemagick:*:*:*:*:*:*:*:* for all versions below 7.1.2-19. The .NET wrapper Magick.NET bundles ImageMagick and is independently affected across multiple NuGet packages below version 14.12.0.

RemediationAI

Upgrade ImageMagick to version 7.1.2-19 or later, available at https://github.com/ImageMagick/ImageMagick/releases/tag/7.1.2-19; this release contains commit 2a06c7be which applies the one-line fix to coders/msl.c. For .NET applications, upgrade affected Magick.NET NuGet packages to version 14.12.0 or later, available at https://github.com/dlemstra/Magick.NET/releases/tag/14.12.0. Red Hat and SUSE users should monitor their respective security advisories for distribution-packaged updates. If immediate patching is not feasible, the most targeted compensating control is to disable MSL coder support via ImageMagick's policy.xml (set rights='none' for the MSL coder), which prevents MSL file processing entirely - this may break any batch scripting workflows that rely on MSL but eliminates the vulnerable code path with no other side effects.

More in Imagemagick

View all
CVE-2017-15277 MEDIUM POC
6.5 Oct 12

ReadGIFImage in coders/gif.c in ImageMagick 7.0.6-1 and GraphicsMagick 1.3.26 leaves the palette uninitialized when proc
CVE-2016-5841 CRITICAL POC
9.8 Dec 13

Integer overflow in MagickCore/profile.c in ImageMagick before 7.0.2-1 allows remote attackers to cause a denial of serv
CVE-2016-3717 MEDIUM POC
5.5 May 05

The LABEL coder in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allows remote attackers to read arbitrary files vi
CVE-2016-5118 CRITICAL
9.8 Jun 10

The OpenBlob function in blob.c in GraphicsMagick before 1.3.24 and ImageMagick allows remote attackers to execute arbit
CVE-2016-5689 CRITICAL POC
9.8 Dec 13

The DCM reader in ImageMagick before 6.9.4-5 and 7.x before 7.0.1-7 allows remote attackers to have unspecified impact b
CVE-2016-5690 CRITICAL POC
9.8 Dec 13

The ReadDCMImage function in DCM reader in ImageMagick before 6.9.4-5 and 7.x before 7.0.1-7 allows remote attackers to

CVE-2016-5691 CRITICAL POC
9.8 Dec 13

The DCM reader in ImageMagick before 6.9.4-5 and 7.x before 7.0.1-7 allows remote attackers to have unspecified impact b
CVE-2017-14138 CRITICAL POC
9.8 Sep 04

ImageMagick 7.0.6-5 has a memory leak vulnerability in ReadWEBPImage in coders/webp.c because memory is not freed in cer
CVE-2026-23876 CRITICAL POC
9.8 Jan 20

Heap buffer overflow in ImageMagick's XBM image decoder (ReadXBMImage) lets remote attackers write attacker-controlled d
CVE-2023-34152 CRITICAL POC
9.8 May 30

A vulnerability was found in ImageMagick. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable
CVE-2019-19952 CRITICAL POC
9.8 Dec 24

In ImageMagick 7.0.9-7 Q16, there is a use-after-free in the function MngInfoDiscardObject of coders/png.c, related to R
CVE-2018-14551 CRITICAL POC
9.8 Jul 23

The ReadMATImageV4 function in coders/mat.c in ImageMagick 7.0.8-7 uses an uninitialized variable, leading to memory cor

Same weakness CWE-193 – Off-by-one Error

View all
CVE-2021-3156 HIGH POC
7.8
CVE-2022-34970 CRITICAL POC
9.8
CVE-2021-31875 CRITICAL POC
9.8
CVE-2020-8443 CRITICAL POC
9.8
CVE-2019-14532 CRITICAL POC
9.8
CVE-2019-13306 HIGH POC
7.8
CVE-2019-13305 HIGH POC
7.8
CVE-2021-23017 HIGH POC
7.7

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Vendor StatusVendor

SUSE

Severity: Medium
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed
SUSE Linux Enterprise Module for Desktop Applications 15 SP7 Fixed
SUSE Linux Enterprise Module for Development Tools 15 SP7 Fixed
SUSE Linux Enterprise Module for Package Hub 15 SP7 Fixed

Share

CVE-2026-40312 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy