CVE-2026-40312: 
C# vulnerability analysis and mitigation

CVE-2026-40312 is an off-by-one error in the MSL (Magick Scripting Language) decoder of ImageMagick that can cause a crash (denial of service) when a malicious MSL file is processed. It affects all ImageMagick versions below 7.1.2-19, as well as the Magick.NET wrapper library prior to version 14.12.0. The vulnerability was disclosed on April 13, 2026, and has a CVSS v3.1 base score of 5.5 (Medium) per Feedly/NVD, or 6.2 (Medium) per the GitHub Security Advisory (GitHub Advisory, Red Hat Bugzilla).

The root cause is an off-by-one error (CWE-193) in the MSLPushImage function within coders/msl.c. Specifically, the code incorrectly incremented msl_info->group_info[msl_info->number_groups].numImages++ instead of msl_info->group_info[msl_info->number_groups-1].numImages++, causing an out-of-bounds array access when processing MSL group structures. The fix, committed in patch commit 2a06c7b, corrects the index by subtracting one. Exploitation requires a local attacker to supply a crafted MSL file to an ImageMagick process, with user interaction (file processing) as a precondition (GitHub Advisory, Patch Commit).

Successful exploitation results in a crash of the ImageMagick process, causing a denial of service condition with high availability impact. There is no impact on confidentiality or data integrity, as the vulnerability only triggers an application crash. Systems or services that automatically process user-supplied image files (e.g., web applications using ImageMagick for image conversion) are at elevated risk if MSL file processing is enabled (GitHub Advisory, Red Hat Bugzilla).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of disclosure (Feedly). The EPSS score is approximately 0.012%, reflecting a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported.

1. Craft a malicious MSL file: Create an MSL (Magick Scripting Language) file that triggers the off-by-one condition in the MSL decoder's MSLPushImage function — specifically by constructing group structures that cause number_groups to be used as an array index without the required -1 offset.
2. Deliver the file to the target: Place the malicious MSL file in a location accessible to the target ImageMagick process, such as uploading it to a web application that accepts image files for processing, or providing it directly on a shared local system.
3. Trigger processing: Cause ImageMagick to process the malicious MSL file, for example via convert malicious.msl output.png or through an application that invokes ImageMagick on user-supplied files.
4. Achieve denial of service: The off-by-one array access in coders/msl.c triggers an out-of-bounds memory access, causing the ImageMagick process to crash and resulting in a denial of service (GitHub Advisory, Patch Commit).

• Logs: Application or system logs showing ImageMagick process crashes (segmentation faults or fatal errors) when processing MSL files; entries referencing ResourceLimitFatalError or MemoryAllocationFailed in ImageMagick output.
• File System: Presence of unexpected or externally supplied .msl files in directories used by ImageMagick for processing; core dump files generated by crashed ImageMagick processes.
• Process: Repeated abnormal termination of convert, magick, or other ImageMagick binaries, particularly when processing files with .msl extensions or MIME types associated with MSL content.

Upgrade ImageMagick to version 7.1.2-19 or later, which contains the one-line fix in coders/msl.c (ImageMagick Release). Users of the Magick.NET .NET wrapper should upgrade to version 14.12.0 or later (Magick.NET Release). As a workaround prior to patching, restrict local access to systems running ImageMagick, implement input validation to reject MSL files before processing, and disable MSL decoder support if not required by the application (Red Hat Bugzilla).

The vulnerability was reported by researcher COCOP1l0t and published via the GitHub Security Advisory program by ImageMagick maintainer dlemstra on April 13–14, 2026 (GitHub Advisory). Red Hat tracked the issue via Bugzilla and rated it medium severity (Red Hat Bugzilla). OpenSUSE and Debian issued security advisories for their respective ImageMagick packages, and Amazon Linux also released an update (ALAS2-2026-3278). No significant social media discussion or notable researcher commentary beyond standard advisory channels has been observed.