CVE-2026-40312
Off-by-One Error in ImageMagick MSL Decoder Causes Crash
Publication date: 2026-04-13
Last updated on: 2026-04-17
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| imagemagick | imagemagick | to 7.1.2-19 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-193 | A product calculates or uses an incorrect maximum or minimum value that is 1 more, or 1 less, than the correct value. |
Attack-Flow Graph
AI Powered Q&A
How can this vulnerability impact me? :
The vulnerability can cause ImageMagick to crash when processing a specially crafted malicious MSL file. This results in a denial of service condition, potentially disrupting services or applications that rely on ImageMagick for image processing.
Can you explain this vulnerability to me?
This vulnerability is an off-by-one error in the MSL decoder of ImageMagick versions below 7.1.2-19. It occurs when a malicious MSL file is read, which can cause the software to crash.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, you should upgrade ImageMagick to version 7.1.2-19 or later, where the off-by-one error in the MSL decoder has been fixed.