CVE-2026-46523: ImageMagick Heap-Use-After-Free in MSL Processing

Technical summary

CVE-2026-46523 is a heap-use-after-free vulnerability (CWE-416, CWE-825) in ImageMagick's image processing pipeline. A malicious or corrupted MSL image file can cause the image parser to reference memory that has already been freed, leading to undefined behavior. The vulnerability requires local file system access and no user privileges, making it exploitable in automated image processing workflows or scenarios where untrusted images are processed server-side. The fix addresses the root cause in memory management during MSL parsing, implemented in versions 7.1.2.23 and 6.9.13-48.

Business impact

Organizations running ImageMagick for batch image processing, web applications accepting user-uploaded images, or automated media pipelines face denial-of-service risk. A crashed image processing service can disrupt document conversions, thumbnail generation, or media workflows. In multi-tenant or cloud environments where one customer's malicious image could crash shared processing infrastructure, blast radius expands. The MEDIUM severity reflects availability impact rather than confidentiality or integrity compromise, but operational availability is mission-critical for many imaging-dependent services.

Affected systems

ImageMagick versions prior to 7.1.2.23 (current branch) and prior to 6.9.13-48 (legacy branch) are vulnerable. This includes any system that processes MSL image files without the patched versions—common in web servers, content management systems, document processors, and containerized microservices. Organizations should audit deployment inventories, including versions bundled in third-party applications or Docker images.

Exploitability

Exploitation requires local file system access to place or inject a crafted MSL image into a processing queue. The vulnerability does not require special user privileges or interaction—a service account running ImageMagick will trigger the defect if it processes the malicious file. Remote exploitation is possible only in scenarios where an application accepts file uploads and processes them with vulnerable ImageMagick versions. No known public exploit code or weaponization has been reported at this publication date, and the vulnerability is not on the CISA Known Exploited Vulnerabilities (KEV) catalog.

Remediation

Upgrade ImageMagick to version 7.1.2.23 or later for the current branch, or to version 6.9.13-48 or later for the legacy branch. Verify the upgrade by checking the version string post-installation. For organizations unable to patch immediately, implement input validation to reject or sandbox MSL image files, and consider disabling MSL processing if not required by business logic. Apply patches across all instances, including those in containerized environments or third-party bundled distributions.

Patch guidance

Apply security updates from the official ImageMagick project sources. If you operate version 7.x, upgrade to 7.1.2.23 or a later release in that series; if you maintain version 6.x, apply 6.9.13-48 or later. Both patches are required to fully address heap-use-after-free; partial upgrades leave vulnerability windows open. Test patched versions in a staging environment to confirm compatibility with your image processing workflows, especially if you use custom delegates or scripting extensions. Coordinate patches across development, staging, and production systems.

Detection guidance

Monitor ImageMagick process crashes or segmentation faults, particularly in logs from image processing services or web upload handlers. Enable verbose logging in ImageMagick to capture file parsing errors. Detection-as-code: watch for unexpected terminations of ImageMagick processes when processing MSL files, and correlate with recent file uploads or batch job submissions. Network-based detection is not feasible since the vulnerability is local-file-triggered. Incident response: if a crash occurs, preserve the triggering image file for forensic analysis to confirm whether a malicious MSL file was involved.

Why prioritize this

While this is a MEDIUM severity vulnerability without active KEV listing or public exploit, it warrants timely patching because: (1) image processing is ubiquitous in web and automation infrastructure; (2) the defect is in memory-unsafe code that could be chained with other flaws; (3) local attackers in multi-user or containerized environments can disrupt shared services; (4) the fix is straightforward and low-risk. Organizations processing user-supplied images should prioritize this within their standard patch cycle (typically 30–60 days for medium-severity items).

Risk score, explained

CVSS 3.1 score of 6.2 (MEDIUM) reflects: local attack vector (AV:L), low complexity (AC:L), no privileges required (PR:N), no user interaction (UI:N), unchanged scope (S:U), no confidentiality impact (C:N), no integrity impact (I:N), but high availability impact (A:H). The score appropriately captures that an attacker can reliably crash the process and deny image processing services, but cannot read data or modify files. This aligns with the heap-use-after-free's ability to trigger a fault but not to reliably achieve code execution.

Frequently asked questions