CVE-2026-23952: 
C# vulnerability analysis and mitigation

CVE-2026-23952 is a NULL pointer dereference vulnerability in ImageMagick's MSL (Magick Scripting Language) parser that allows network-accessible attackers to cause a denial of service by processing maliciously crafted MSL files containing <comment> tags before any image is loaded. It affects ImageMagick versions prior to 6.9.13-38 (6.x branch) and 7.0.0-0 through 7.1.2-12 (7.x branch), as well as Magick.NET versions prior to 14.10.2. The vulnerability was discovered by Team FuzzingBrain at Texas A&M University and disclosed on January 20, 2026. It carries a CVSS v3.1 base score of 6.5 (Medium) per the GitHub Advisory, though NVD assigns 7.5 (High) (Github Advisory, ImageMagick Advisory).

The root cause (CWE-476: NULL Pointer Dereference) lies in coders/msl.c at line 7091, where the MSLEndElement() function calls DeleteImageProperty() on msl_info->image[n] when handling the closing </comment> tag without first verifying that the image pointer is non-NULL. When a <comment> tag appears in an MSL script before any image-loading operation, msl_info->image[n] remains NULL, triggering an assertion failure in MagickCore/property.c:297 (Assertion 'image != (Image *) NULL' failed) in debug builds, or a NULL pointer dereference crash in release builds. An attacker can exploit this remotely by supplying a crafted MSL file to any application that passes user-controlled input to ImageMagick's MSL parser, requiring only low privileges. A proof-of-concept fuzzer and reproduction steps using magick MSL:poc.msl out.png are publicly documented in the advisory (ImageMagick Advisory).

Successful exploitation results in a crash of the ImageMagick process or any application embedding it, causing a denial of service with high availability impact. There is no confidentiality or integrity impact — the vulnerability cannot be used to read or modify data. Applications that accept user-supplied MSL scripts or image files for processing (e.g., web services, image conversion pipelines) are at greatest risk of service disruption (Github Advisory, Red Hat Bugzilla).

1. Craft a malicious MSL file: Create a file (e.g., poc.msl) containing a <comment> tag placed before any image-loading directive, such as:

<?xml version="1.0" encoding="UTF-8"?>
<image>
  <comment>trigger</comment>
</image>

2. Identify a target: Locate a service or application that accepts user-supplied files and processes them with ImageMagick (e.g., an image conversion API, upload endpoint, or CLI wrapper) running a vulnerable version (ImageMagick < 6.9.13-38 or 7.0.0-0 to 7.1.2-12, or Magick.NET < 14.10.2).
3. Submit the malicious file: Upload or pass the crafted poc.msl to the target application, or invoke directly via CLI: magick MSL:poc.msl out.png.
4. Trigger the crash: The MSL parser's MSLEndElement() function calls DeleteImageProperty() on a NULL image pointer when processing the </comment> tag, causing an assertion failure (debug builds) or NULL pointer dereference (release builds), crashing the process and causing denial of service (ImageMagick Advisory).

• Logs: Application or system logs showing abrupt termination of ImageMagick processes with messages such as MagickCore/property.c:297: MagickBooleanType DeleteImageProperty(Image *, const char *): Assertion 'image != (Image *) NULL' failed or segmentation fault signals (SIGSEGV/SIGABRT) from the magick or convert process.
• File System: Presence of unexpected .msl files in upload directories or temporary processing folders, particularly those containing <comment> tags without preceding image-load operations.
• Process: Repeated crashes or restarts of image-processing worker processes; core dump files generated by the ImageMagick process in the working directory.
• Network: Repeated submissions of MSL-format files (MIME type application/xml or files with .msl extension) to image processing endpoints, especially from a single source IP (ImageMagick Advisory).

Update ImageMagick to version 6.9.13-38 or later (6.x branch) or 7.1.2-13 or later (7.x branch); update Magick.NET to version 14.10.2 or later. Debian, Ubuntu (USN-8127-1), Amazon Linux 2 (ALAS2-2026-3132), SUSE, and Red Hat have issued distribution-level advisories and updated packages. As an interim workaround where patching is not immediately possible, restrict network access to services that process ImageMagick files, disable MSL processing via ImageMagick's security policy (policy.xml), and avoid accepting user-supplied MSL scripts (ImageMagick Advisory, Magick.NET Release, Red Hat Bugzilla).

The vulnerability was disclosed by the ImageMagick maintainer (dlemstra) via GitHub Security Advisories on January 20, 2026, and credited to Team FuzzingBrain at Texas A&M University for responsible disclosure through fuzzing. Red Hat tracked the issue via Bugzilla (Bug 2431905) and rated it medium severity. Multiple Linux distributions including Debian (DLA-4448-1, DSA-6111-1), Ubuntu (USN-8127-1), Amazon Linux 2, and SUSE issued security updates. Tenable published multiple Nessus detection plugins (IDs 296505, 296648, 297973, 299061, 301813) for the vulnerability (ImageMagick Advisory, Red Hat Bugzilla).