6.2

CVE-2026-40312: imagemagick Off-by-one Error

CVSS: 6.2v3.1MediumAnalyzed
AliasesUBUNTU-CVE-2026-40312DEBIAN-CVE-2026-40312CGA-5r28-6x7x-c954
Published 13-04-2026Last modified 14-04-2026
Open JSON

Vulnerability summary

CVE-2026-40312 is a medium (CVSS 6.2) Off-by-one Error vulnerability in imagemagick. EPSS estimates a 0.18% chance of exploitation in the next 30 days, higher than 6.8% of scored vulnerabilities.

Overall risk
25/100
0100
Medium · default modelHow is this calculated?
CVSS score
6.2/10
010
Medium · v3.1 (CVE.org)
EPSS score
0.18%
0%100%
Low · 0.00 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 5 · Related 6
OPENSUSE-SU-2026:10586-1OPENSUSE-SU-2026:20606-1SUSE-SU-2026:1597-1SUSE-SU-2026:1598-1USN-8810-1CGA-5QC9-C28F-Q7QP

Timeline

  1. 13-04-2026
    PublishedVulnerability first disclosed.
  2. 14-04-2026
    Last modifiedVulnerability information updated.

Description

ImageMagick is free and open-source software used for editing and manipulating digital images. In versions below 7.1.2-19, an off by one error in the MSL decoder could result in a crash when a malicous MSL file is read. This issue has been fixed in version 7.1.2-19.

CVSS metrics

6 scores · 6 sources · 1 version

EPSS trend

Probability

0.18%

Chance of exploitation in the next 30 days

Percentile

7%

Versus all other CVEs

30-day change

0.00 pp

From 0.18% on 19-09-2026

19-09-202619-10-2026
EPSS score
0.18%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

NuGet17 products
  • magick.net-q16-anycpu< 14.12.0
  • Magick.NET-Q16-arm64< 14.12.0
  • magick.net-q16-hdri-anycpu< 14.12.0
  • Magick.NET-Q16-HDRI-arm64< 14.12.0
  • Magick.NET-Q16-HDRI-OpenMP-arm64< 14.12.0
Chainguard4 products
  • imagemagick-6All versions (No fix recorded)
  • imagemagick-6-dev< 6.9.13.46-r1
  • imagemagick-6-doc< 6.9.13.46-r1
  • imagemagick-6-static< 6.9.13.46-r1
Debian1 product
  • imagemagick< 8:7.1.1.43+dfsg1-1+deb13u8 | < 8:7.1.2.19+dfsg1-1
Imagemagick1 product
Ubuntu1 product
  • imagemagick< 8:6.7.7.10-6ubuntu3.13+esm25 | < 8:6.9.7.4+dfsg-16ubuntu6.15+esm16 | < 8:6.9.10.23+dfsg-2.1ubuntu11.11+esm14 | < 8:6.9.11.60+dfsg-1.3ubuntu0.22.04.5+esm14 | < 8:6.9.12.98+dfsg1-5.2ubuntu0.1~esm13 | All versions (No fix recorded) | < 8:7.1.2.18+dfsg1-1ubuntu0.1~esm3

5 vendors · 24 products

References

11 links
Show all 11 references