CVE-2026-25983: ImageMagick has Use After Free in MSLStartElement in "coders/msl.c"
A crafted MSL script triggers a heap-use-after-free. The operation element handler replaces and frees the image while the parser continues reading from it, leading to a UAF in ReadBlobString during further parsing.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-25983?
CVE-2026-25983 is considered a critical vulnerability due to its potential for exploitation through a heap-use-after-free condition.
How do I fix CVE-2026-25983?
To fix CVE-2026-25983, update your ImageMagick installation to version 7.1.2-15 or later and 6.9.13-40 or later.
Which versions of ImageMagick are affected by CVE-2026-25983?
CVE-2026-25983 affects ImageMagick versions prior to 7.1.2-15 and 6.9.13-40.
What type of vulnerability is CVE-2026-25983?
CVE-2026-25983 is classified as a use-after-free vulnerability, impacting memory management in ImageMagick.
Are there any known exploits for CVE-2026-25983?
As of now, specific exploits for CVE-2026-25983 have not been publicly disclosed, but the nature of the vulnerability poses considerable risk.