CVE-2026-23952: ImageMagick NULL Pointer DoS Vulnerability

CVE-2026-23952 Overview

A NULL pointer dereference vulnerability exists in ImageMagick, the widely-used open-source software for editing and manipulating digital images. The flaw resides in the Magick Scripting Language (MSL) parser when processing <comment> tags before images are loaded. This vulnerability affects ImageMagick versions 14.10.1 and below, potentially leading to Denial of Service (DoS) conditions through assertion failures in debug builds or NULL pointer dereferences in release builds.

Critical Impact
Attackers can crash ImageMagick processes by submitting specially crafted MSL files containing <comment> tags, causing service disruption in applications that rely on ImageMagick for image processing operations.

Affected Products

ImageMagick versions 14.10.1 and below
Magick.NET versions prior to 14.10.2
Applications and services utilizing vulnerable ImageMagick libraries for MSL parsing

Discovery Timeline

2026-01-22 - CVE-2026-23952 published to NVD
2026-01-22 - Last updated in NVD database

Technical Details for CVE-2026-23952

Vulnerability Analysis

This vulnerability is classified as CWE-476 (NULL Pointer Dereference), a memory corruption issue that occurs when the application attempts to use a pointer that references a NULL location in memory. In the context of ImageMagick, the MSL parser fails to properly validate the state of image objects before processing <comment> tags. When a <comment> element appears in an MSL script before any image has been loaded or instantiated, the parser attempts to access properties of a non-existent image object, resulting in a NULL pointer dereference.

The vulnerability is network-exploitable, meaning an attacker can trigger it remotely by submitting malicious MSL content to applications that accept user-supplied image scripts. The attack requires low privileges and no user interaction, making it relatively straightforward to exploit in vulnerable environments.

Root Cause

The root cause lies in insufficient state validation within the MSL parser's comment handling routine. The parser assumes that an image context is always available when processing <comment> tags, but this assumption fails when comments appear before any <image> elements have been processed. The absence of a NULL check before dereferencing the image pointer leads to the vulnerability.

In debug builds, this triggers an assertion failure that terminates the process. In release builds, the NULL pointer dereference causes undefined behavior, typically resulting in a segmentation fault and process crash.

Attack Vector

The attack vector is network-based, requiring an attacker to deliver a malicious MSL file or script to a vulnerable ImageMagick installation. Common attack scenarios include:

Web applications that accept MSL scripts for image processing
Document conversion services that process embedded ImageMagick scripts
Content management systems utilizing ImageMagick for media manipulation
API endpoints that expose MSL parsing functionality

The vulnerability can be triggered with a relatively simple payload structure: an MSL script containing a <comment> tag positioned before any <image> element is defined. When the parser encounters this tag without a valid image context, the crash condition occurs.

Detection Methods for CVE-2026-23952

Indicators of Compromise

Unexpected ImageMagick process crashes or segmentation faults in application logs
Assertion failure messages in debug builds referencing MSL parser or comment handling functions
Repeated service restarts of applications utilizing ImageMagick for image processing
Core dump files generated by ImageMagick processes with NULL pointer access patterns

Detection Strategies

Monitor application logs for ImageMagick crash signatures, particularly those mentioning NULL pointer access or assertion failures
Implement input validation to detect MSL files with <comment> tags appearing before <image> elements
Deploy web application firewalls with rules to inspect and filter suspicious MSL content
Use static analysis tools to identify applications passing untrusted input to ImageMagick MSL parser

Monitoring Recommendations

Configure crash monitoring and alerting for services using ImageMagick libraries
Enable verbose logging for ImageMagick operations to capture pre-crash state information
Implement rate limiting on endpoints accepting MSL or image processing requests
Monitor for unusual patterns of failed image processing requests that may indicate exploitation attempts

How to Mitigate CVE-2026-23952

Immediate Actions Required

Upgrade ImageMagick to version 14.10.2 or later immediately
Upgrade Magick.NET to version 14.10.2 or later for .NET applications
Audit applications to identify all instances where MSL parsing is enabled or exposed
Implement input validation to reject MSL files from untrusted sources until patching is complete

Patch Information

The vulnerability has been addressed in ImageMagick version 14.10.2. The fix implements proper NULL checking in the MSL parser's comment handling routine, ensuring that the image context is validated before any operations are performed on it.

For detailed information about the security fix, refer to the GitHub Security Advisory. The patched release for Magick.NET is available at the GitHub Magick.NET Release page.

Workarounds

Disable MSL parsing functionality if not required by your application
Implement strict input validation to reject MSL scripts with <comment> tags before <image> elements
Sandbox ImageMagick processes to limit the impact of crashes on overall system stability
Use ImageMagick policy files to restrict allowed operations and file types

bash

# ImageMagick policy configuration to disable MSL parsing
# Add to /etc/ImageMagick-7/policy.xml or equivalent

# Disable MSL coder entirely if not needed
# <policy domain="coder" rights="none" pattern="MSL" />

# Alternatively, restrict resource limits to minimize DoS impact
# <policy domain="resource" name="memory" value="256MiB"/>
# <policy domain="resource" name="map" value="512MiB"/>
# <policy domain="resource" name="disk" value="1GiB"/>