CVE-2026-46523: 
C# vulnerability analysis and mitigation

CVE-2026-46523 is a heap-use-after-free vulnerability in ImageMagick's MSL (Magick Scripting Language) image decoder, classified as Use-After-Free in MSL decoder. It affects ImageMagick versions prior to 7.1.2-23 and prior to 6.9.13-48 (6.x branch), as well as Magick.NET NuGet packages prior to version 14.13.1. The vulnerability was published by GitHub Advisory (GHSA-5r4x-w6p5-222q) on May 17–18, 2026, and added to the NVD on June 10, 2026. It carries a CVSS v3.1 base score of 6.2 (Medium) (GitHub Advisory, Red Hat Bugzilla).

The root cause is a CWE-416 (Use After Free) memory management flaw — and additionally CWE-825 (Expired Pointer Dereference) — in ImageMagick's MSL image decoder. When processing a specially crafted MSL image file, the decoder frees a heap-allocated memory region but subsequently dereferences the now-invalid pointer, triggering a heap-use-after-free condition. The attack vector is local (the attacker must be able to supply a malicious MSL image file to the application), requires no privileges, and requires no user interaction beyond the application processing the file. The vulnerability was reported by researcher meridian0x01 (GitHub Advisory, Feedly).

Successful exploitation results in a denial of service through application crash, as the heap-use-after-free causes undefined behavior that terminates the ImageMagick process. There is no confidentiality or integrity impact — the CVSS scoring reflects a high availability impact only. In environments where ImageMagick is used as a backend image processing service (e.g., web applications, media pipelines), an attacker who can submit crafted MSL images could repeatedly crash the service, causing sustained unavailability (GitHub Advisory, Red Hat Bugzilla).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported for CVE-2026-46523. The EPSS score is approximately 0.013% (2nd percentile), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Detection coverage exists via multiple Nessus plugins (IDs: 316469, 316527, 316926, 318000, 318051) (GitHub Advisory, Feedly).

1. Craft a malicious MSL file: Create a specially crafted MSL (Magick Scripting Language) image file designed to trigger the use-after-free condition in ImageMagick's MSL decoder during parsing.
2. Deliver the file: Place the crafted MSL file in a location accessible to the target ImageMagick process — for example, upload it to a web application that processes user-supplied images, or provide it as input to a local ImageMagick command.
3. Trigger processing: Cause ImageMagick to process the malicious file (e.g., via convert malicious.msl output.png or through an application API that invokes ImageMagick).
4. Achieve denial of service: The MSL decoder frees a heap buffer and then dereferences the freed pointer, causing a crash (SIGSEGV or heap corruption abort) and terminating the ImageMagick process or the hosting application (GitHub Advisory).

• Process: Unexpected crashes or segmentation faults (SIGSEGV) in the convert, magick, or other ImageMagick binaries, particularly when processing MSL-format files.
• Logs: Application or system logs showing heap-use-after-free errors, AddressSanitizer (ASAN) reports, or core dump generation associated with ImageMagick processes.
• File System: Presence of unexpected .msl files in upload directories or temporary processing folders, especially with unusual or obfuscated content.
• System: Repeated core dumps (e.g., core.* files) in the working directory of the ImageMagick process, or crash reports referencing the MSL decoder code path.

Upgrade ImageMagick to version 7.1.2-23 (7.x branch) or 6.9.13-48 (6.x branch), which contain the fix for this vulnerability. For Magick.NET users, upgrade to version 14.13.1 or later. As a workaround where upgrading is not immediately possible, restrict or disable processing of MSL image files by configuring ImageMagick's policy.xml to deny the MSL coder (<policy domain="coder" rights="none" pattern="MSL" />). Amazon Linux 2 users can apply the update via ALAS2-2026-3346, and Debian users should apply the available distribution updates (GitHub Advisory, Red Hat Bugzilla).

The vulnerability was reported by researcher meridian0x01 and disclosed responsibly through GitHub's security advisory process by ImageMagick maintainer dlemstra. Red Hat has tracked the issue via Bugzilla (Bug 2487743) with a high severity rating, and multiple Linux distributions including Debian and Amazon Linux 2 have issued package updates. No significant broader media coverage or notable social media discussion has been identified beyond standard vulnerability tracking channels (GitHub Advisory, Red Hat Bugzilla).