CVE-2026-23952

A flaw was found in ImageMagick. A remote attacker could exploit a NULL pointer dereference vulnerability in the Magick Scripting Language (MSL) parser. This occurs when processing <comment> tags before images are loaded. Successful exploitation can lead to a Denial of Service (DoS) attack, making the software unavailable.

This vulnerability is rated Moderate for Red Hat products. A NULL pointer dereference flaw exists in ImageMagick's MSL parser when processing <comment> tags before image loading. This could allow an attacker to cause a Denial of Service (DoS) by providing a specially crafted image file. This affects ImageMagick versions 14.10.1 and below, as shipped in various Red Hat products including EPEL and Red Hat Enterprise Linux Extended Life Cycle Support (ELS) releases.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this issue, users should avoid processing untrusted or specially crafted MSL (Magick Scripting Language) files with ImageMagick. Restricting the sources of MSL files and ensuring that ImageMagick only processes trusted input can reduce the risk of exploitation. If ImageMagick is used in an automated pipeline, consider implementing sandboxing mechanisms to limit the impact of potential denial-of-service attacks.