What is the CVSS score of CVE-2026-23952?

CVE-2026-23952 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.0%.

Which versions of Imagemagick are affected by CVE-2026-23952?

Organizations using ImageMagick should be aware of notable risk from CVE-2026-23952, a null pointer dereference vulnerability rated CVSS 6.5.. A patch is available.

Is there a public PoC exploit available for CVE-2026-23952?

Yes, a public proof-of-concept exploit is available for CVE-2026-23952. Prioritise patching immediately. EPSS: 0.0%.

Imagemagick CVE-2026-23952

MEDIUM

NULL Pointer Dereference (CWE-476)

2026-01-22 security-advisories@github.com

GHSA-5vx3-wx4q-6cj8

Denial Of Service Null Pointer Dereference Red Hat Imagemagick Magick.Net Suse

6.5

CVSS 3.1

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Patch released

Mar 31, 2026 - 08:00 nvd

Patch available

Analysis Generated

Mar 12, 2026 - 21:54 vuln.today

PoC Detected

Feb 27, 2026 - 15:35 vuln.today

Public exploit code

CVE Published

Jan 22, 2026 - 01:15 nvd

MEDIUM 6.5

DescriptionNVD

ImageMagick is free and open-source software used for editing and manipulating digital images. Versions 14.10.1 and below have a NULL pointer dereference vulnerability in the MSL (Magick Scripting Language) parser when processing <comment> tags before images are loaded. This can lead to DoS attack due to assertion failure (debug builds) or NULL pointer dereference (release builds). This issue is fixed in version 14.10.2.

AnalysisAI

ImageMagick and Magick.NET versions 14.10.1 and below are vulnerable to denial of service attacks through a null pointer dereference in the MSL parser when processing malformed comment tags, exploitable by authenticated attackers without user interaction. Public exploit code exists for this vulnerability, and affected systems may crash or experience assertion failures depending on build configuration. …

RemediationAI

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Monitor vendor channels for patch availability.

Analysis

Detailed AI-generated intelligence summary covering attack vector, impact assessment, affected versions, remediation steps, and indicators of compromise.

POChttps://••••••••••.com/exploit

PATCHhttps://••••••••••.com/patch

ADVISORYhttps://••••••••••.com/advisory