← Back

CVE-2026-23952

nvd nist
Published: Jan 22, 2026Modified: Feb 27, 2026

JSON object

Loading...
7.5
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Exploitability: 3.9 / Impact: 3.6
Source: NVD

Description

ImageMagick is free and open-source software used for editing and manipulating digital images. Versions 14.10.1 and below have a NULL pointer dereference vulnerability in the MSL (Magick Scripting Language) parser when processing <comment> tags before images are loaded. This can lead to DoS attack due to assertion failure (debug builds) or NULL pointer dereference (release builds). This issue is fixed in version 14.10.2.

Affected (3)

Imagemagick
1 product
Imagemagick
Dlemstra
1 product
Magick.net
Configuration A
2 vulnerable
Vulnerable SoftwareAffected Versions
Imagemagick
Imagemagick
Before 6.9.13-38
Imagemagick
From 7.0.0-0 to 7.1.2-13
Configuration B
1 vulnerable
Vulnerable SoftwareAffected Versions
Magick.net
Before 14.10.2

Related CWEs

CWE-476
NULL Pointer Dereference
The product dereferences a pointer that it expects to be valid but is NULL.

References (2)

Source: security-advisories@github.com
ExploitVendor Advisory
Source: security-advisories@github.com
ProductRelease Notes

Timeline

No history available yet.