CVE-2026-23952

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

ImageMagick is free and open-source software used for editing and manipulating digital images. Versions 14.10.1 and below have a NULL pointer dereference vulnerability in the MSL (Magick Scripting Language) parser when processing <comment> tags before images are loaded. This can lead to DoS attack due to assertion failure (debug builds) or NULL pointer dereference (release builds). This issue is fixed in version 14.10.2.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-476

Affected software

Vendor	Product	Versions
ImageMagick	ImageMagick	< 14.10.2

References

https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-5vx3-wx4q-6cj8Exploit, Vendor Advisory
https://github.com/dlemstra/Magick.NET/releases/tag/14.10.2Product, Release Notes

Timeline

Published: Jan 22, 2026
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-239538.7Incus is a system container and virtual machine manager. In versions 6.20.0 and below, a user with the ability to launch a container with a CVE-2026-239548.7Incus is a system container and virtual machine manager. Versions 6.21.0 and below allow a user with the ability to launch a container with CVE-2026-239554.2EVerest is an EV charging software stack. Prior to version 2025.9.0, in several places, integer values are concatenated to literal strings w CVE-2026-239567.5seroval facilitates JS value stringification, including complex structures beyond JSON.stringify capabilities. In versions 0.2.0 through 1.4 CVE-2026-239577.5seroval facilitates JS value stringification, including complex structures beyond JSON.stringify capabilities. In versions 1.4.0 and below, CVE-2026-239589.8Dataease is an open source data visualization analysis tool. Prior to version 2.10.19, DataEase uses the MD5 hash of the user’s password as CVE-2026-239594.9CoreShop is a Pimcore enhanced eCommerce solution. An error-based SQL Injection vulnerability was identified in versions prior to 4.1.9 in t CVE-2026-23964.4The List View Google Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the event description in all versions up CVE-2026-239605.4Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. Prior to versions 3.6.17 an CVE-2026-239615.3Mastodon is a free, open-source social network server based on ActivityPub. Mastodon allows server administrators to suspend remote users to CVE-2026-239627.5Mastodon is a free, open-source social network server based on ActivityPub. Mastodon versions before v4.3.18, v4.4.12, and v4.5.5 do not hav CVE-2026-239636.5Mastodon is a free, open-source social network server based on ActivityPub. Prior to versions 4.5.5, 4.4.12, and 4.3.18, the server does not