6.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-23952

CVE-2026-23952: ImageMagick has a NULL pointer dereference in MSL parser via <comment> tag before image load

ImageMagick is free and open-source software used for editing and manipulating digital images. Versions 14.10.1 and below have a NULL pointer dereference vulnerability in the MSL (Magick Scripting Language) parser when processing <comment> tags before images are loaded. This can lead to DoS attack due to assertion failure (debug builds) or NULL pointer dereference (release builds). This issue is fixed in version 14.10.2.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-23952

CVE-2026-23952:

6.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
Magick.NET-Q8-x64	nuget	< 14.10.2	14.10.2
Magick.NET-Q8-arm64	nuget	< 14.10.2	14.10.2
Magick.NET-Q8-x86	nuget	< 14.10.2	14.10.2
Magick.NET-Q8-OpenMP-x64	nuget	< 14.10.2	14.10.2
Magick.NET-Q8-OpenMP-arm64	nuget	< 14.10.2	14.10.2
Magick.NET-Q16-x64	nuget	< 14.10.2	14.10.2
Magick.NET-Q16-arm64	nuget	< 14.10.2	14.10.2
Magick.NET-Q16-x86	nuget	< 14.10.2	14.10.2
Magick.NET-Q16-OpenMP-x64	nuget	< 14.10.2	14.10.2
Magick.NET-Q16-OpenMP-arm64	nuget	< 14.10.2	14.10.2
Magick.NET-Q16-OpenMP-x86	nuget	< 14.10.2	14.10.2
Magick.NET-Q16-HDRI-x64	nuget	< 14.10.2	14.10.2
Magick.NET-Q16-HDRI-arm64	nuget	< 14.10.2	14.10.2
Magick.NET-Q16-HDRI-x86	nuget	< 14.10.2	14.10.2
Magick.NET-Q16-HDRI-OpenMP-x64	nuget	< 14.10.2	14.10.2
Magick.NET-Q16-HDRI-OpenMP-arm64	nuget	< 14.10.2	14.10.2
Magick.NET-Q8-AnyCPU	nuget	< 14.10.2	14.10.2
Magick.NET-Q16-AnyCPU	nuget	< 14.10.2	14.10.2
Magick.NET-Q16-HDRI-AnyCPU	nuget	< 14.10.2	14.10.2

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability, identified as GHSA-5vx3-wx4q-6cj8, is a NULL pointer dereference in the Magick Scripting Language (MSL) parser of ImageMagick. The root cause lies within the MSLEndElement function in coders/msl.c. This function processes the closing tags of MSL elements. Specifically, when handling the </comment> and </label> end tags, the code calls DeleteImageProperty on an image object, msl_info->image[n]. The vulnerability arises because the code does not verify that this image object is non-NULL before the call. An attacker can craft an MSL file where a <comment> or <label> tag appears before any image is loaded via a <read> tag. In this scenario, msl_info->image[n] is NULL, and the subsequent call to DeleteImageProperty results in a NULL pointer dereference, crashing the application. The patch for this vulnerability introduces a check to ensure msl_info->image[n] is not NULL before calling DeleteImageProperty, thus mitigating the denial-of-service risk.

Vulnerable functions

MSLEndElement

coders/msl.c

The vulnerability exists in the `MSLEndElement` function, which is responsible for handling the closing tags in an MSL file. The function attempts to delete an image property when it encounters a `</comment>` or `</label>` tag. However, it fails to check if an image has been loaded (`msl_info->image[n]` is not NULL) before performing this operation. If a malicious MSL file is provided that contains a `<comment>` or `<label>` tag before any `<read>` operation, `msl_info->image[n]` will be NULL. This leads to a NULL pointer dereference when `DeleteImageProperty` is called, causing a denial of service.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.