The MSL interpreter crashes when processing a invalid <map> element that causes it to use an image after it has been freed.
{
"cwe_ids": [
"CWE-476"
],
"github_reviewed": true,
"github_reviewed_at": "2026-02-24T15:46:49Z",
"nvd_published_at": "2026-02-24T03:16:02Z",
"severity": "MODERATE"
}