CVE-2026-25983
📋 TL;DR
This CVE describes a heap-use-after-free vulnerability in ImageMagick's MSL (Magick Scripting Language) parser. Attackers can exploit this by crafting malicious MSL scripts to potentially execute arbitrary code or cause denial of service. Users running vulnerable versions of ImageMagick that process untrusted MSL scripts are affected.
💻 Affected Systems
- ImageMagick
📦 What is this software?
Imagemagick by Imagemagick
Imagemagick by Imagemagick
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete system compromise if the attacker can control MSL script input and successfully exploit the memory corruption.
Likely Case
Application crash (denial of service) or limited information disclosure due to memory corruption.
If Mitigated
No impact if ImageMagick is not processing untrusted MSL scripts or if proper input validation is in place.
🎯 Exploit Status
Exploitation requires crafting a malicious MSL script and getting it processed by vulnerable ImageMagick. No public exploit code is known at this time.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 7.1.2-15 or 6.9.13-40
Vendor Advisory: https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-fwqw-2x5x-w566
Restart Required: No
Instructions:
1. Update ImageMagick to version 7.1.2-15 or 6.9.13-40 using your package manager. 2. For Linux: 'sudo apt update && sudo apt upgrade imagemagick' (Debian/Ubuntu) or 'sudo yum update imagemagick' (RHEL/CentOS). 3. For source installations: Download latest version from imagemagick.org and recompile.
🔧 Temporary Workarounds
Disable MSL support
linuxPrevent ImageMagick from processing MSL scripts by disabling MSL support in policy.xml
Edit /etc/ImageMagick-6/policy.xml or /etc/ImageMagick-7/policy.xml and add: <policy domain="coder" rights="none" pattern="MSL" />
Restrict MSL file processing
allConfigure ImageMagick to reject MSL files through policy restrictions
Add to policy.xml: <policy domain="path" rights="none" pattern="*.msl" />
🧯 If You Can't Patch
- Disable MSL script processing in ImageMagick configuration
- Implement strict input validation to reject MSL scripts from untrusted sources
🔍 How to Verify
Check if Vulnerable:
Check ImageMagick version: 'convert --version' or 'magick --version'. If version is below 7.1.2-15 (for ImageMagick 7) or below 6.9.13-40 (for ImageMagick 6), system is vulnerable.Check Version:
convert --version | head -1Verify Fix Applied:
After update, verify version shows 7.1.2-15 or higher (for IM7) or 6.9.13-40 or higher (for IM6). Test with a simple MSL script to ensure it processes without crashing.📡 Detection & Monitoring
Log Indicators:
- ImageMagick process crashes with segmentation faults
- Error messages related to MSL parsing failures
- Unusual memory access patterns in system logs
Network Indicators:
- Unusual uploads of MSL files to web applications
- MSL file extensions in HTTP requests
SIEM Query:
ImageMagick AND (crash OR segmentation OR "heap-use-after-free")