Description

ImageMagick before 7.1.2-30 and 6.9.x before 6.9.13-55 contains a heap-use-after-free vulnerability in the Layer method of PerlMagick. An attacker who supplies a crafted list of images can trigger memory access after deallocation, resulting in a crash (denial of service).

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "3.3",
  "pubDate": "2026-09-07T13:20:41.543Z",
  "pubdate": "2026-09-07T13:20:41.543Z",
  "executiveSummary": "A critical memory corruption vulnerability exists within the PerlMagick interface of ImageMagick, specifically manifesting as a heap use-after-free defect in the Layer method.\nThe vulnerability affects ImageMagick versions prior to 7.1.2-30 and 6.9.x versions prior to 6.9.13-55.\nSuccessful exploitation occurs when an attacker provides a maliciously crafted list of images to the PerlMagick processing engine, triggering an invalid memory access after the underlying object has been deallocated.\nThe primary security impact is a denial-of-service (DoS) condition via application crash; however, memory corruption vulnerabilities of this nature may theoretically provide a vector for arbitrary code execution depending on the heap layout and state at the time of exploitation.\nThis vulnerability poses a risk to any system or web application utilizing ImageMagick for processing user-supplied image content via Perl scripts.\nNo specific authentication or high-level privileges are inherently required if the application interface is publicly exposed or accessible to untrusted users.",
  "technicalDetails": "The vulnerability resides within the PerlMagick module's Layer method, which is responsible for manipulating multi-frame image sequences or layer stacks. The root cause is an improper memory management implementation leading to a use-after-free condition during the iteration or modification of the image list container.\nThe attack flow initiates when an attacker submits a crafted sequence of images designed to trigger specific error conditions or edge-case processing within the Layer method. During the execution of the method, the internal ImageMagick structures—specifically those managing the image pointers or metadata associated with the layers—are deallocated while the program logic still retains a reference to those memory addresses.\nWhen the program subsequently attempts to access the deallocated memory location (the dangling pointer), a heap use-after-free condition is triggered. This occurs because the memory allocator may have already returned the vacated block to the free pool, where it potentially was reallocated for a different purpose, leading to unpredictable program state or immediate process termination (segmentation fault).\nBecause PerlMagick provides a high-level binding to the core ImageMagick C library, the vulnerability exposes the underlying heap memory directly. The exploitation path involves manipulating the Perl-level object list so that the Layer function reaches an inconsistent state during list traversal. By controlling the contents of the image list, an attacker influences the pointer arithmetic and the sequence of operations that result in the premature freeing of the image objects.\nThis vulnerability is strictly tied to the interaction between the Perl interpreter and the native C-based ImageMagick libraries. Since the memory management issue is intrinsic to the Layer implementation, standard security controls that do not intercept at the library level are insufficient to prevent the crash.\nAffected software versions include all ImageMagick releases prior to 7.1.2-30 and 6.9.x releases prior to 6.9.13-55. The impact is primarily a service disruption; however, in environments where PerlMagick is used within a long-running process or a shared persistent memory space, the corruption of heap pointers could potentially be leveraged to alter internal control structures or gain code execution if the memory reclamation is successfully groomed by an attacker."
}