CVE-2026-86423: ImageMagick before 7.1.2-30 Heap-use-after-free via GetList
ImageMagick before 7.1.2-30 and 6.9.x before 6.9.13-55 contains a heap-use-after-free vulnerability in the GetList method of PerlMagick. A crafted call to the GetList method can trigger the use-after-free, resulting in a crash (denial of service).
Affected Software
Event History
Frequently Asked Questions
Which deployments should be checked first?
Check deployments that use PerlMagick and invoke its GetList method. ImageMagick versions before 7.1.2-30 and 6.9.x versions before 6.9.13-55 are affected.
What does an attacker need to trigger the issue?
The issue is triggered through a crafted call to PerlMagick's GetList method. The supplied vector indicates local access and user interaction are required, while no privileges are required.
What is the expected impact of successful exploitation?
Successful triggering causes a heap use-after-free that can crash the affected process, resulting in denial of service. The provided severity vector indicates no confidentiality or integrity impact.