CVE-2026-46523: ImageMagick Use-After-Free Vulnerability

CVE-2026-46523 Overview

CVE-2026-46523 is a heap use-after-free vulnerability [CWE-416] in ImageMagick, the open-source image manipulation suite. A crafted Magick Scripting Language (MSL) image triggers the flaw during processing. The defect affects ImageMagick versions prior to 7.1.2.23 and 6.9.13-48. Maintainers fixed the issue in versions 7.1.2.23 and 6.9.13-48. The vulnerability requires local access and no privileges or user interaction. Successful exploitation produces a high availability impact, while confidentiality and integrity remain unaffected.

Critical Impact

A crafted MSL image processed by a vulnerable ImageMagick build dereferences freed heap memory, crashing the process and disrupting any service that relies on automated image conversion.

Affected Products

• ImageMagick versions prior to 7.1.2.23 (7.x branch)
• ImageMagick versions prior to 6.9.13-48 (6.x branch)
• Applications and services that embed vulnerable ImageMagick libraries for MSL processing

Discovery Timeline

• 2026-06-10 - CVE-2026-46523 published to NVD
• 2026-06-10 - Last updated in NVD database

Technical Details for CVE-2026-46523

Vulnerability Analysis

The flaw is a heap use-after-free condition triggered when ImageMagick parses a crafted MSL document. MSL is ImageMagick's XML-based scripting format that drives image operations through declarative commands. During processing of a malicious MSL payload, the parser releases a heap object and later dereferences a pointer that still references the freed memory. The reused allocation produces undefined behavior and reliably terminates the process. The issue is local in scope and impacts availability of the host process, including batch converters, thumbnail generators, and any pipeline that hands attacker-supplied MSL to convert, magick, or library bindings such as MagickWand or PerlMagick.

Root Cause

The root cause is improper lifetime management of a heap-allocated object inside the MSL processing path. The code releases the object during one parsing step but retains references that subsequent steps dereference. CWE-416 (Use After Free) classifies this defect class. Memory allocator behavior determines whether the freed slot returns valid data, attacker-influenced data, or unmapped memory, which is why exploitation is non-deterministic but crashes are consistent.

Attack Vector

Exploitation requires the attacker to supply a crafted MSL file to a vulnerable ImageMagick process. The vector is local because MSL processing is typically restricted, yet many environments accept MSL through automated workflows, shared file shares, or build pipelines. No authentication or user interaction is required once the file reaches the parser. The vulnerability affects availability only; confidentiality and integrity remain intact under the published scoring.

No verified proof-of-concept code is publicly available. For the technical fix, see the GitHub Security Advisory GHSA-5r4x-w6p5-222q.

Detection Methods for CVE-2026-46523

Indicators of Compromise

• Repeated crashes or SIGSEGV signals in magick, convert, or MagickCore-linked processes during image conversion jobs.
• Unexpected MSL files (.msl extension or files beginning with <?xml and <image> tags) submitted through user-facing upload paths.
• Core dumps that show faulting addresses inside MSL handler functions in libMagickCore.

Detection Strategies

• Inventory installed ImageMagick versions across servers and developer workstations, flagging anything below 7.1.2.23 or 6.9.13-48.
• Inspect application configurations and policy.xml to determine whether the MSL coder is enabled.
• Hunt for processes invoking ImageMagick with file inputs whose MIME type or magic bytes do not match the declared extension.

Monitoring Recommendations

• Alert on abnormal exit codes and segmentation faults from image processing workers in production.
• Forward ImageMagick stderr logs and process exit telemetry to centralized logging for correlation.
• Monitor file upload services for MSL payloads and quarantine unexpected scripting formats before they reach the converter.

How to Mitigate CVE-2026-46523

Immediate Actions Required

• Upgrade to ImageMagick 7.1.2.23 or 6.9.13-48 on every host, container image, and CI runner that processes untrusted images.
• Rebuild and redeploy applications that statically link or bundle ImageMagick libraries.
• Audit dependency manifests, base container images, and language bindings such as PerlMagick, MagickWand, and wand Python package for vulnerable versions.

Patch Information

The ImageMagick maintainers fixed the heap use-after-free in versions 7.1.2.23 (7.x branch) and 6.9.13-48 (6.x branch). Patch details are documented in the GitHub Security Advisory GHSA-5r4x-w6p5-222q. Apply distribution updates as soon as backported packages become available from your operating system vendor.

Workarounds

• Disable the MSL coder in policy.xml until patched binaries are deployed across the environment.
• Reject MSL files at the application layer through MIME type and magic-byte validation before invoking ImageMagick.
• Run ImageMagick inside a sandbox or container with strict resource limits to contain crashes and prevent service-wide outages.

# Disable the MSL coder in ImageMagick policy.xml
# Add the following inside the <policymap> element:
<policy domain="coder" rights="none" pattern="MSL" />
<policy domain="coder" rights="none" pattern="MSL:*" />

# Verify the policy is active
identify -list policy | grep -i msl