SecuriTricks - CVE-2026-40312

Description

ImageMagick is free and open-source software used for editing and manipulating digital images. In versions below 7.1.2-19, an off by one error in the MSL decoder could result in a crash when a malicous MSL file is read. This issue has been fixed in version 7.1.2-19.

Product(s) Impacted

Vendor	Product	Versions
Imagemagick	Imagemagick	<7.1.2-19

Weaknesses

Common security weaknesses mapped to this vulnerability.

CWE-193

Off-by-one Error

A product calculates or uses an incorrect maximum or minimum value that is 1 more, or 1 less, than the correct value.

*CPE(s)

Affected systems and software identified for this CVE.

Type	Vendor	Product	Version	Update	Edition	Language	Software Edition	Target Software	Target Hardware	Other Information
a	imagemagick	imagemagick	<7.1.2-19	/	/	/	/	/	/	/

References

https://github.com/ImageMagick/ImageMagick/commit/2a06c7be3bba3326caf8b7a8d1fa2e0d4b88998d

https://github.com/ImageMagick/ImageMagick/releases/tag/7.1.2-19

https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-5xg3-585r-9jh5

https://github.com/dlemstra/Magick.NET/releases/tag/14.12.0

CVSS Score

6.2 / 10

CVSS Data - 3.1

Attack Vector: LOCAL
Attack Complexity: LOW
Privileges Required: NONE
Scope: UNCHANGED
Confidentiality Impact: NONE
Integrity Impact: NONE
Availability Impact: HIGH

CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

View Vector String

Timeline

Published: April 13, 2026, 10:16 p.m.
Last Modified: April 13, 2026, 10:16 p.m.

Status : Received

CVE has been recently published to the CVE List and has been received by the NVD.

More info

Source

[email protected]

CVE-2026-40312