CVE Intelligence
Analysis AI-assisted

CVE-2026-25983: ImageMagick use-after-free in MSL parser (coders/msl.c)

CVE-2026-25983 is a heap use-after-free (CWE-416) in ImageMagick's MSL parser, triggered by a crafted MSL script. The record states that versions 7.1.2-15 and 6.9.13-40 contain a patch, and the NVD base score is 9.8 while a GitHub score in the record is 5.3. The CISA KEV catalog does not list it and no confirmed exploitation appears in the sources consulted.

Published Oct 24, 2026 · Updated Oct 24, 2026 · Ler em português

Overview

This entry covers CVE-2026-25983, a use-after-free (CWE-416) in the MSL handling code of ImageMagick, in the MSLStartElement routine of coders/msl.c. According to the record, a crafted MSL script causes an image to be freed while the parser still reads from it.

Impact

  • The record describes a heap use-after-free that occurs during MSL parsing, with a later UAF in ReadBlobString.
  • The NVD base score is 9.8 (Critical) with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. A GitHub-provided score in the record is 5.3.
  • The SSVC fields in the record indicate the issue is automatable with partial technical impact.
  • The sources consulted do not state the full consequences, such as whether code execution is possible.

Affected products and versions

  • Product in the record: ImageMagick.
  • The record lists versions before 6.9.13-40 as affected.
  • The record lists versions from 7.0.0-0 up to but not including 7.1.2-15 as affected.
  • The description states that versions 7.1.2-15 and 6.9.13-40 contain a patch.

Exploitation status

The CISA KEV catalog does not list this CVE in the record. No confirmed exploitation appears in the sources consulted. The SSVC exploitation field in the record is none.

Remediation and mitigation

  • Upgrade ImageMagick to 6.9.13-40 or later on the 6.x branch, or to 7.1.2-15 or later on the 7.x branch.
  • Until upgrading is complete, avoid processing MSL files from untrusted sources, since the issue is triggered by crafted MSL input.
  • Review services and pipelines that pass user-supplied files to ImageMagick and restrict them where possible.

Detection guidance

  • Inventory all ImageMagick installations, including packaged, bundled and container copies, and record their versions.
  • Monitor for crashes or abnormal terminations of ImageMagick processes, especially when handling MSL input.
  • Review logs of applications that convert user-supplied images with ImageMagick.

Limitations of the available information

The record has an empty fixes list, so structured fixed-version data is missing. The patch versions are taken from the description. The NVD and GitHub CVSS scores differ. The EPSS date in the record is 2026-10-23, which is later than the publication date, so it should be verified against the source. Exploitation details are not included in the sources consulted.

Frequently asked questions

Is CVE-2026-25983 listed as actively exploited?

The CISA KEV entry in the record is not listed, and no confirmed exploitation appears in the sources consulted.

Which versions contain the patch?

The description states that versions 7.1.2-15 and 6.9.13-40 contain a patch. Upgrading to these or later releases on each branch is the recommended remediation.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.