CVE-2026-23952CWE-476

ImageMagick has a NULL pointer dereference in MSL parser via <comment> tag before image load

Medium · published January 22, 2026

CVSS v3.1
6.5
EPSS
0%
Percentile
39.8
In the wild
Unconfirmed
What it is

ImageMagick is free and open-source software used for editing and manipulating digital images. Versions 14.10.1 and below have a NULL pointer dereference vulnerability in the MSL (Magick Scripting Language) parser when processing <comment> tags before images are loaded. This can lead to DoS attack due to assertion failure (debug builds) or NULL pointer dereference (release builds). This issue is fixed in version 14.10.2.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.00471 · 39.8th percentile
Weakness
CWE-476 · NULL Pointer Dereference
Published
2026-01-22T00:32Z
EPSS history
Timeline
  • 22 JAN 00:32Z
    ImageMagick has a NULL pointer dereference in MSL parser via <comment> tag before image load
    cvelistv5