Executive brief
ImageMagick is a widely used open-source image processing library. A heap-use-after-free vulnerability in the PerlMagick binding's GetList method can be triggered by a crafted call, causing the application to crash and deny service to legitimate users.
Technical details
A heap-use-after-free vulnerability (CWE-416) exists in the GetList method of PerlMagick, the Perl binding for ImageMagick. The vulnerability is triggered by a crafted call to GetList, which accesses memory that has already been freed. The attack vector is local with low complexity and requires user interaction (a user must be tricked into calling the vulnerable method). Successful exploitation results in application crash and denial of service. The vulnerability is patched in ImageMagick 7.1.2-30 and 6.9.13-55.
Affected products
- ImageMagick ImageMagick 7.1.2 before 7.1.2-30; 6.9.x before 6.9.13-55
Timeline
- 2026-08-23: disclosed: GitHub Security Advisory published
- 2026-09-07: advisory: NVD entry published
- 2026-08-23: patched: Patched in versions 7.1.2-30 and 6.9.13-55