CVE-2026-40312: ImageMagick MSL Decoder DoS Vulnerability

CVE-2026-40312 Overview

CVE-2026-40312 is an off-by-one error vulnerability in the MSL (Magick Scripting Language) decoder component of ImageMagick, a widely-used open-source software suite for image editing and manipulation. When a maliciously crafted MSL file is processed, this boundary condition error triggers an application crash, resulting in a denial of service condition. The vulnerability affects all ImageMagick versions prior to 7.1.2-19.

Critical Impact

Processing a malicious MSL file can crash the ImageMagick process, causing denial of service conditions in applications that rely on ImageMagick for image processing operations.

Affected Products

• ImageMagick versions prior to 7.1.2-19
• Magick.NET versions prior to 14.12.0
• Applications and services using vulnerable ImageMagick library versions for MSL file processing

Discovery Timeline

• April 13, 2026 - CVE-2026-40312 published to NVD
• April 13, 2026 - Last updated in NVD database

Technical Details for CVE-2026-40312

Vulnerability Analysis

This vulnerability is classified as CWE-193 (Off-by-One Error), a common software flaw that occurs when a loop iterates one time too many or too few, or when calculations are off by a single unit. In the context of the MSL decoder, this error manifests in the coders/msl.c file where array index calculations incorrectly reference memory positions.

The attack requires local access to deliver a malicious MSL file to the target system. No user interaction is required once the file reaches an application that processes it with ImageMagick. The vulnerability results in complete availability impact, causing application crashes that can disrupt services dependent on ImageMagick for image processing workflows.

Root Cause

The root cause lies in incorrect array indexing within the MSL decoder's group information handling. Specifically, when incrementing the numImages counter for group information, the code was accessing msl_info->group_info[msl_info->number_groups] instead of the correct msl_info->group_info[msl_info->number_groups-1]. Since arrays in C are zero-indexed, this off-by-one error causes the code to write to a memory location outside the intended bounds when number_groups is non-zero.

Attack Vector

The attack vector requires an adversary to craft a malicious MSL file that triggers the vulnerable code path during parsing. This typically involves:

1. Creating an MSL file with specific group structure configurations
2. Delivering the file to a target system through file upload, email attachment, or other file transfer mechanisms
3. Having the file processed by an application using a vulnerable ImageMagick version

The exploitation is straightforward once the malicious file reaches a vulnerable ImageMagick installation, as no special privileges or user interaction are needed to trigger the crash.

// Security patch in coders/msl.c
// Source: https://github.com/ImageMagick/ImageMagick/commit/2a06c7be3bba3326caf8b7a8d1fa2e0d4b88998d

       (msl_info->attributes[n] == (Image *) NULL))
     ThrowFatalException(ResourceLimitFatalError,"MemoryAllocationFailed")
   if (msl_info->number_groups != 0)
-    msl_info->group_info[msl_info->number_groups].numImages++;
+    msl_info->group_info[msl_info->number_groups-1].numImages++;
   return(n);
 }

The patch corrects the array index by subtracting 1 from number_groups, ensuring the correct zero-indexed array element is accessed.

Detection Methods for CVE-2026-40312

Indicators of Compromise

• Unexpected ImageMagick process crashes when processing MSL files
• Core dumps or crash logs indicating segmentation faults in the MSL decoder
• Presence of unusual or malformed MSL files in upload directories or processing queues

Detection Strategies

• Monitor application logs for ImageMagick crash events related to MSL file processing
• Implement file integrity monitoring on ImageMagick binaries to detect version changes
• Use SentinelOne's Singularity platform to detect anomalous process terminations in image processing workflows
• Deploy static analysis tools to scan for CVE-2026-40312 in software inventory

Monitoring Recommendations

• Enable crash reporting and analysis for services utilizing ImageMagick
• Configure alerting for repeated ImageMagick process restarts or failures
• Monitor file upload endpoints for suspicious MSL file submissions
• Track ImageMagick library versions across your environment using software composition analysis tools

How to Mitigate CVE-2026-40312

Immediate Actions Required

• Upgrade ImageMagick to version 7.1.2-19 or later immediately
• Update Magick.NET to version 14.12.0 or later if using the .NET wrapper
• Audit systems for vulnerable ImageMagick installations using package managers or vulnerability scanners
• Implement input validation to restrict MSL file processing where not explicitly required

Patch Information

ImageMagick has released version 7.1.2-19 which addresses this vulnerability. The fix is available through the official GitHub release. For .NET implementations, the Magick.NET 14.12.0 release includes the patched ImageMagick library. Full details of the vulnerability are documented in the GitHub Security Advisory GHSA-5xg3-585r-9jh5.

Workarounds

• Disable MSL file processing if not required by your application by configuring ImageMagick policy restrictions
• Implement strict file type validation to reject MSL files from untrusted sources
• Use application sandboxing to limit the impact of potential crashes on critical services
• Consider containerization to isolate ImageMagick processing from core application infrastructure

# Configuration example - Restrict MSL decoder in ImageMagick policy.xml
# Location: /etc/ImageMagick-7/policy.xml

# Add this policy to disable MSL coder:
<policy domain="coder" rights="none" pattern="MSL" />

# Alternative: Restrict all potentially dangerous coders
<policy domain="coder" rights="none" pattern="{MSL,URL,HTTPS,HTTP,FTP}" />