Fluid Attacks Database

Description

ImageMagick: Invalid MSL can result in a use after free The MSL interpreter crashes when processing a invalid <map> element that causes it to use an image after it has been freed.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Component	Affected version	Patched versions
nuget	magick.net-q16-arm64	>=0 <14.10.3	14.10.3
nuget	magick.net-q8-anycpu	>=0 <14.10.3	14.10.3
debian 12	imagemagick	=8:6.9.11.60+dfsg-1.6 \|\| =8:6.9.11.60+dfsg-1.6+deb12u1 \|\| =8:6.9.11.60+dfsg-1.6+deb12u2 \|\| =8:6.9.11.60+dfsg-1.6+deb12u3 \|\| =8:6.9.11.60+dfsg-1.6+deb12u4 \|\| =8:6.9.11.60+dfsg-1.6+deb12u5 \|\| =8:6.9.11.60+dfsg-1.6+deb12u6 \|\| =8:6.9.11.60+dfsg-1.6+deb12u7 \|\| >=0 <8:6.9.11.60+dfsg-1.6+deb12u8	8:6.9.11.60+dfsg-1.6+deb12u8
nuget	magick.net-q16-hdri-openmp-x64	>=0 <14.10.3	14.10.3
nuget	magick.net-q16-anycpu	>=0 <14.10.3	14.10.3
nuget	magick.net-q16-hdri-anycpu	>=0 <14.10.3	14.10.3
nuget	magick.net-q16-hdri-openmp-arm64	>=0 <14.10.3	14.10.3
nuget	magick.net-q16-hdri-arm64	>=0 <14.10.3	14.10.3
nuget	magick.net-q16-hdri-x64	>=0 <14.10.3	14.10.3
nuget	magick.net-q16-hdri-x86	>=0 <14.10.3	14.10.3

1-10 of 25

Aliases

1. CVE-2026-269832. NVD-2026-269833. OSV-2026-269834. OSV-DEBIAN-2026-269835. GHSA-w8mw-frc6-r7m86. GCVE-2026-269837. SECURITY-TRACKER-CVE-2026-26983

References

1. https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-w8mw-frc6-r7m82. https://github.com/ImageMagick/ImageMagick/commit/7cfae4da24a995fb05386d77364ff404a7cca7bc3. https://github.com/dlemstra/Magick.NET/releases/tag/14.10.3

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.