Executive brief
ImageMagick is a widely-used image processing library that developers integrate into applications to manipulate and convert images. A crafted image file can trigger a memory-safety bug in PerlMagick's Layer method, causing the application to crash and become unavailable. An attacker can exploit this by distributing malicious image files to denial-of-service targeted users or systems.
Technical details
This is a heap-use-after-free (CWE-416) vulnerability in the Layer method of PerlMagick, the Perl bindings for ImageMagick. The vulnerability is triggered when a crafted list of images causes the code to access memory that has already been freed, resulting in undefined behavior and typically a crash. The attack vector is local with required user interaction (the user must process a malicious image). An attacker who supplies a specially crafted image file can cause a denial of service. Patches are available in ImageMagick 7.1.2-30 and 6.9.13-55.
Affected products
- ImageMagick ImageMagick before 7.1.2-30, 6.9.x before 6.9.13-55
Timeline
- 2026-08-23: advisory
- 2026-09-07: disclosed