{"id":"CVE-2026-23952","aliases":["GHSA-5vx3-wx4q-6cj8"],"url":"https://o3.security/vulnerability/CVE-2026-23952","summary":"ImageMagick has a NULL pointer dereference in MSL parser via <comment> tag before image load","details":"## Summary\n\nNULL pointer dereference in MSL (Magick Scripting Language) parser when processing `<comment>` tag before any image is loaded.\n\n## Version\n\n- ImageMagick 7.x (tested on current main branch)\n- Commit: HEAD\n\n## Steps to Reproduce\n\n### Method 1: Using ImageMagick directly\n\n```bash\nmagick MSL:poc.msl out.png\n```\n\n### Method 2: Using OSS-Fuzz reproduce\n\n```bash\npython3 infra/helper.py build_fuzzers imagemagick\npython3 infra/helper.py reproduce imagemagick msl_fuzzer poc.msl\n```\n\nOr run the fuzzer directly:\n```bash\n./msl_fuzzer poc.msl\n```\n\n## Expected Behavior\n\nImageMagick should handle the malformed MSL gracefully and return an error message.\n\n## Actual Behavior\n\n```\nconvert: MagickCore/property.c:297: MagickBooleanType DeleteImageProperty(Image *, const char *): Assertion `image != (Image *) NULL' failed.\nAborted\n```\n\n## Root Cause Analysis\n\nIn `coders/msl.c:7091`, `MSLEndElement()` calls `DeleteImageProperty()` on `msl_info->image[n]` when handling the `</comment>` end tag without checking if the image is NULL:\n\n```c\nif (LocaleCompare((const char *) tag,\"comment\") == 0 )\n  {\n    (void) DeleteImageProperty(msl_info->image[n],\"comment\");  // No NULL check\n    ...\n  }\n```\n\nWhen `<comment>` appears before any `<read>` operation, `msl_info->image[n]` is NULL, causing the assertion failure in `DeleteImageProperty()` at `property.c:297`.\n\n## Impact\n\n- **DoS**: Crash via assertion failure (debug builds) or NULL pointer dereference (release builds)\n- **Affected**: Any application using ImageMagick to process user-supplied MSL files\n\n## Fuzzer\n\nThis issue was discovered using a custom MSL fuzzer:\n\n```cpp\n#include <cstdint>\n#include <Magick++/Blob.h>\n#include <Magick++/Image.h>\n#include \"utils.cc\"\n\nextern \"C\" int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size)\n{\n  if (IsInvalidSize(Size))\n    return(0);\n  try\n  {\n    const Magick::Blob blob(Data, Size);\n    Magick::Image image;\n    image.magick(\"MSL\");\n    image.fileName(\"MSL:\");\n    image.read(blob);\n  }\n  catch (Magick::Exception)\n  {\n  }\n  return(0);\n}\n```\n\nThis issue was found by Team FuzzingBrain @ Texas A&M University","published":"2026-01-22T00:32:52.908Z","modified":"2026-10-28T02:31:13.321034516Z","cvss":{"score":6.5,"severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"},"epss":{"score":0.0043,"percentile":0.35356,"asOf":"2026-08-06"},"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"NuGet","name":"Magick.NET-Q8-x64","fixedVersion":"14.10.2"},{"ecosystem":"NuGet","name":"Magick.NET-Q8-arm64","fixedVersion":"14.10.2"},{"ecosystem":"NuGet","name":"Magick.NET-Q8-x86","fixedVersion":"14.10.2"},{"ecosystem":"NuGet","name":"Magick.NET-Q8-OpenMP-x64","fixedVersion":"14.10.2"},{"ecosystem":"NuGet","name":"Magick.NET-Q8-OpenMP-arm64","fixedVersion":"14.10.2"},{"ecosystem":"NuGet","name":"Magick.NET-Q16-x64","fixedVersion":"14.10.2"},{"ecosystem":"NuGet","name":"Magick.NET-Q16-arm64","fixedVersion":"14.10.2"},{"ecosystem":"NuGet","name":"Magick.NET-Q16-x86","fixedVersion":"14.10.2"},{"ecosystem":"NuGet","name":"Magick.NET-Q16-OpenMP-x64","fixedVersion":"14.10.2"},{"ecosystem":"NuGet","name":"Magick.NET-Q16-OpenMP-arm64","fixedVersion":"14.10.2"},{"ecosystem":"NuGet","name":"Magick.NET-Q16-OpenMP-x86","fixedVersion":"14.10.2"},{"ecosystem":"NuGet","name":"Magick.NET-Q16-HDRI-x64","fixedVersion":"14.10.2"},{"ecosystem":"NuGet","name":"Magick.NET-Q16-HDRI-arm64","fixedVersion":"14.10.2"},{"ecosystem":"NuGet","name":"Magick.NET-Q16-HDRI-x86","fixedVersion":"14.10.2"},{"ecosystem":"NuGet","name":"Magick.NET-Q16-HDRI-OpenMP-x64","fixedVersion":"14.10.2"},{"ecosystem":"NuGet","name":"Magick.NET-Q16-HDRI-OpenMP-arm64","fixedVersion":"14.10.2"},{"ecosystem":"NuGet","name":"Magick.NET-Q8-AnyCPU","fixedVersion":"14.10.2"},{"ecosystem":"NuGet","name":"Magick.NET-Q16-AnyCPU","fixedVersion":"14.10.2"},{"ecosystem":"NuGet","name":"Magick.NET-Q16-HDRI-AnyCPU","fixedVersion":"14.10.2"}],"fix":null,"references":[{"type":"WEB","url":"https://github.com/dlemstra/Magick.NET/releases/tag/14.10.2"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/23xxx/CVE-2026-23952.json"},{"type":"ADVISORY","url":"https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-5vx3-wx4q-6cj8"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-23952"},{"type":"PACKAGE","url":"https://github.com/ImageMagick/ImageMagick"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-10-28T02:31:13.321034516Z"}}