CVE-2026-25983: 
C# vulnerability analysis and mitigation

CVE-2026-25983 is a heap-use-after-free vulnerability in ImageMagick's MSL (Magick Scripting Language) decoder, specifically in the MSLStartElement function within coders/msl.c. A crafted MSL script can trigger the flaw when the operation element handler replaces and frees an image object while the parser continues reading from it, resulting in a use-after-free condition in ReadBlobString during further parsing. The vulnerability affects ImageMagick versions prior to 6.9.13-40 (6.x branch) and prior to 7.1.2-15 (7.x branch), as well as Magick.NET NuGet packages prior to version 14.10.3. It was published on February 23–24, 2026. The GitHub Security Advisory rates this as Moderate with a CVSS v3.1 score of 5.3, while Feedly's aggregated data reflects a higher score of 9.8 (Critical) from other sources (GitHub Advisory, Red Hat Bugzilla).

The root cause is a use-after-free (CWE-416) combined with an expired pointer dereference (CWE-825) in the MSL decoder's MSLStartElement handler in coders/msl.c. When processing an <operation> element in a crafted MSL script, the handler replaces and frees the current image object; however, the XML parser continues to read from the now-freed memory region, triggering the UAF in the ReadBlobString function during subsequent parsing. Exploitation requires the attacker to supply a malicious MSL script to an ImageMagick instance that processes it — no authentication or user interaction is required, and the attack vector is network-accessible in deployments that accept remote image/script input. The fix is tracked in commit 257200c in the ImageMagick repository (GitHub Advisory, Github Advisory).

Successful exploitation can result in denial of service through process crash, and potentially information disclosure or arbitrary code execution depending on how the freed memory is reallocated and reused. The primary confirmed impact is availability loss (process termination), but the heap-use-after-free nature of the bug means that in certain memory layout conditions, an attacker could potentially read sensitive data from freed memory or redirect execution flow. Systems that process untrusted MSL scripts or image files via ImageMagick — including web applications, media pipelines, and document converters — are most at risk (GitHub Advisory, Red Hat Bugzilla).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of this report (Feedly). The EPSS score is approximately 0.045% (0.000450), placing it in a low exploitation probability tier. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported. Detection plugins are available from Nessus (e.g., plugin IDs 299948, 301153, 301556) and Qualys (e.g., QID 6032069), indicating broad scanner coverage (Github Advisory).

1. Identify target: Locate a service or application that uses a vulnerable version of ImageMagick (< 6.9.13-40 or 7.x < 7.1.2-15) and accepts user-supplied image or script input that is processed via the MSL decoder.
2. Craft malicious MSL script: Create an MSL script (XML-based) that includes an <operation> element designed to trigger the image replacement and free sequence in MSLStartElement, while additional XML elements follow that cause the parser to continue reading from the freed image pointer.
3. Deliver the payload: Submit the crafted MSL file to the target application — for example, via a file upload endpoint, an image processing API, or a command-line invocation such as convert malicious.msl output.png.
4. Trigger the UAF: The MSL parser processes the <operation> element, frees the image, and then calls ReadBlobString on the freed memory during parsing of subsequent elements, triggering the heap-use-after-free.
5. Achieve objective: Depending on heap state, the outcome ranges from a process crash (denial of service) to potential memory disclosure or code execution if the freed region is reallocated with attacker-controlled data (GitHub Advisory).

• Process: Unexpected termination or crash of ImageMagick processes (e.g., convert, magick) with heap corruption errors or segmentation faults in logs.
• Logs: Application or system logs showing ImageMagick aborting with messages referencing ReadBlobString, MSLStartElement, or heap sanitizer output (e.g., AddressSanitizer heap-use-after-free reports) when processing MSL files.
• File System: Presence of unusual or externally supplied .msl files in upload directories or temporary processing folders.
• Network: Repeated submission of MSL-formatted content to image processing endpoints, particularly files containing <operation> XML elements followed by additional parsing directives.

Upgrade ImageMagick to version 7.1.2-15 or later (7.x branch) or 6.9.13-40 or later (6.x branch). For Magick.NET users, upgrade to version 14.10.3 or later. As a workaround where patching is not immediately possible, disable MSL script processing in ImageMagick's policy configuration (policy.xml) by setting the MSL coder to none, and implement strict input validation to reject .msl files from untrusted sources. Network segmentation to limit which systems can submit files to ImageMagick processing services is also recommended. Distribution-specific patches have been issued by Ubuntu (USN-8069-1), Debian (DSA-6158-1, DSA-6159-1, DLA-4497-1), openSUSE, SUSE, and Amazon Linux 2 (ALAS2-2026-3211) (GitHub Advisory, Red Hat Bugzilla).

The vulnerability was published by maintainer dlemstra via the ImageMagick GitHub Security Advisory program and received moderate attention from the Linux distribution security community, with rapid patch issuance from Ubuntu, Debian, SUSE, openSUSE, and Amazon Linux. Red Hat tracked the issue as medium severity in Bugzilla. No notable independent researcher commentary or significant social media discussion has been identified beyond standard vulnerability aggregator coverage (GitHub Advisory, Red Hat Bugzilla).