Description

ImageMagick before 7.1.2-30 and 6.9.x before 6.9.13-55 contains a heap-use-after-free vulnerability in the GetList method of PerlMagick. A crafted call to the GetList method can trigger the use-after-free, resulting in a crash (denial of service).

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "3.3",
  "pubDate": "2026-09-07T13:20:41.263Z",
  "pubdate": "2026-09-07T13:20:41.263Z",
  "executiveSummary": "A heap-use-after-free vulnerability exists in the GetList method of PerlMagick, a Perl interface for ImageMagick.\nThis flaw allows a local or remote attacker to trigger a memory corruption event by submitting a specially crafted call to the affected method.\nSuccessful exploitation results in an application crash, causing a Denial of Service (DoS) condition.\nAffected products include ImageMagick versions prior to 7.1.2-30 and 6.9.x versions prior to 6.9.13-55.\nThe vulnerability poses a risk to system stability in environments where untrusted user input is processed through the PerlMagick interface.\nWhile the primary impact documented is a crash, memory corruption vulnerabilities of this type may theoretically offer a vector for further exploitation if memory state can be manipulated, though current impact is limited to service availability.",
  "technicalDetails": "The vulnerability is located within the PerlMagick extension, specifically residing in the GetList method implementation.\nThe root cause is a heap-use-after-free (UAF) condition, which occurs when the application attempts to reference a memory address that has already been deallocated.\nIn the context of the GetList method, an improper handling of the Perl object lifecycle or pointer references during the retrieval of internal ImageMagick structures leads to the violation.\nThe attack flow begins when an attacker provides a crafted request or input that interacts with the PerlMagick interface. By manipulating the parameters passed to the GetList method, an attacker can induce the application to free a heap-allocated buffer while maintaining a dangling pointer to that memory segment.\nSubsequent execution logic then attempts to access or dereference this freed memory, leading to an undefined state within the process address space. This access violation triggers an immediate abort or segmentation fault, effectively terminating the ImageMagick process.\nThis vulnerability affects ImageMagick versions prior to 7.1.2-30 and 6.9.x versions prior to 6.9.13-55. The exploitation does not explicitly require elevated privileges beyond the ability to execute code that triggers the vulnerable PerlMagick method.\nBecause the vulnerability involves the heap allocator, the behavior can be non-deterministic, but consistently triggered via malformed input parameters that force the execution path into the vulnerable code block.\nPost-exploitation impact is primarily characterized by service unavailability; however, since heap management is being compromised, there is a technical potential for memory disclosure or arbitrary code execution if an attacker can precisely manipulate the heap layout to place controlled data into the freed memory region before the dangling pointer is utilized, although this remains highly complex and context-dependent."
}