logo

Database

Insecure functionality In magick.net-q16-hdri-arm64

Description

ImageMagick has Use After Free in MSLStartElement in "coders/msl.c" A crafted MSL script triggers a heap-use-after-free. The operation element handler replaces and frees the image while the parser continues reading from it, leading to a UAF in ReadBlobString during further parsing.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem
Component
Affected version
Patched versions

1-10 of 24

10

Aliases

1. CVE-2026-259832. NVD-2026-259833. OSV-2026-259834. OSV-DEBIAN-2026-259835. GHSA-fwqw-2x5x-w5666. GCVE-2026-259837. SECURITY-TRACKER-CVE-2026-25983

References

1. https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-fwqw-2x5x-w5662. https://github.com/ImageMagick/ImageMagick/commit/257200cb21de23404dce5f8261871845d425dee53. https://github.com/dlemstra/Magick.NET/releases/tag/14.10.3

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.