CVE-2026-86423 in ImageMagick
Summary
by MITRE • 09/07/2026
ImageMagick before 7.1.2-30 and 6.9.x before 6.9.13-55 contains a heap-use-after-free vulnerability in the GetList method of PerlMagick. A crafted call to the GetList method can trigger the use-after-free, resulting in a crash (denial of service).
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 09/07/2026
The identified security flaw resides within ImageMagick versions prior to 7.1.2-30 and 6.9.x prior to 6.9.13-55, specifically affecting the PerlMagick interface which serves as a bridge between the core C library and the Perl programming language environment. This vulnerability is classified as a heap-use-after-free error within the GetList method, representing a critical memory management failure where the software attempts to access memory that has already been deallocated by the system. In complex image processing libraries like ImageMagick, objects are frequently created, manipulated, and destroyed during high-throughput operations such as parsing large or malformed image files. The PerlMagick layer must carefully manage references between Perl data structures and underlying C pointers to prevent dangling pointer issues. When a crafted call is directed at the GetList method, it triggers an internal state where memory is freed while still being referenced by another part of the application logic, leading to undefined behavior that typically manifests as a segmentation fault or process crash.
From a technical perspective, this vulnerability aligns with Common Weakness Enumeration identifier CWE-416, which describes use-after-free conditions resulting from improper management of dynamically allocated memory. The root cause lies in the lifecycle management within the PerlMagick bindings, where reference counting mechanisms may fail to account for all active pointers before releasing associated resources. An attacker can exploit this by submitting a specially crafted input file or API call that forces the application into an execution path where the GetList method returns a pointer to memory that has already been returned to the heap allocator. Because modern operating systems employ various mitigations such as Address Space Layout Randomization and non-executable heaps, direct code execution via this specific vector is often difficult without additional auxiliary vulnerabilities. However, the reliability of triggering a crash makes it particularly effective for denial-of-service attacks against services that process untrusted image data.
The operational impact of this vulnerability centers on availability rather than confidentiality or integrity in its immediate form. Since the primary consequence described is a crash resulting from the use-after-free condition, malicious actors can disrupt image processing pipelines by sending specific requests to servers running vulnerable versions of ImageMagick with PerlMagick enabled. This affects web applications that allow users to upload images for previewing, resizing, or format conversion, as well as automated systems that batch-process visual assets. A successful exploitation leads to service interruption, requiring manual restarts of affected processes and potentially causing data loss if in-memory operations are not persisted before the crash occurs. For organizations relying on continuous image processing workflows, such instability can result in significant downtime and operational costs associated with incident response and system recovery.
To mitigate this risk, immediate action should be taken to upgrade ImageMagick to version 7.1.2-30 or later for the major branch, or version 6.9.13-55 or later for the legacy 6.x series. These releases contain patches that correct the memory management logic within the GetList method and reinforce reference counting integrity in PerlMagick. In environments where upgrading is not immediately feasible, administrators should restrict access to ImageMagick services by implementing strict input validation filters at the network perimeter using web application firewalls or reverse proxies. Additionally, disabling unnecessary modules such as PerlMagick if they are not actively used can reduce the attack surface. Monitoring system logs for segmentation faults and abnormal process terminations associated with image processing tasks will aid in detecting potential exploitation attempts while mitigation strategies are deployed. This vulnerability is also relevant to ATT&CK technique T1499, Endpoint Denial of Service, as it enables attackers to degrade or halt service availability through resource exhaustion via crafted inputs rather than brute force methods.