A crafted MSL script triggers a heap-use-after-free. The operation element handler replaces and frees the image while the parser continues reading from it, leading to a UAF in ReadBlobString during further parsing.
{
"nvd_published_at": "2026-02-24T02:16:02Z",
"severity": "MODERATE",
"github_reviewed": true,
"github_reviewed_at": "2026-02-24T15:43:54Z",
"cwe_ids": [
"CWE-416"
]
}