CVE-2026-86423 Overview
CVE-2026-86423 is a heap use-after-free vulnerability in ImageMagick's PerlMagick binding. The flaw resides in the GetList method and affects ImageMagick versions before 7.1.2-30 and 6.9.x before 6.9.13-55. A crafted call to GetList triggers access to freed heap memory, causing the process to crash. The impact is limited to denial of service against applications that expose PerlMagick to untrusted input. The vulnerability is classified under CWE-416: Use After Free and requires local access with user interaction to exploit.
Critical Impact
Attackers with local access can crash PerlMagick-based image processing workflows by invoking the vulnerable GetList method with crafted arguments.
Affected Products
- ImageMagick versions before 7.1.2-30
- ImageMagick 6.9.x versions before 6.9.13-55
- PerlMagick binding shipped with the affected ImageMagick builds
Discovery Timeline
- 2026-09-07 - CVE-2026-86423 published to NVD
- 2026-09-09 - Last updated in NVD database
Technical Details for CVE-2026-86423
Vulnerability Analysis
The vulnerability lives in PerlMagick, the Perl binding for ImageMagick that lets scripts drive image transformations from Perl code. The GetList method manages an internal list of image handles and their associated heap allocations. When invoked with crafted arguments, GetList continues to reference a heap object after that object has been freed. The subsequent dereference reads or writes freed memory, corrupting allocator metadata and terminating the process. The result is a reliable denial-of-service condition against any Perl application that passes untrusted parameters through PerlMagick.
Root Cause
The root cause is improper lifetime management of heap-allocated image list entries inside PerlMagick's GetList implementation. An object is released while a pointer to it remains reachable through the list, violating the invariant enforced by CWE-416. Details are documented in the GitHub Security Advisory GHSA-5m9j-96ff-j6qc.
Attack Vector
Exploitation requires local access and user interaction, matching the AV:L and UI:P components of the CVSS vector. An attacker must supply a crafted call sequence to GetList through a PerlMagick-based script, typically by influencing arguments processed by a local automation job, batch converter, or developer tool. Successful exploitation crashes the ImageMagick process but does not directly compromise confidentiality or integrity. See the VulnCheck advisory for additional technical context.
// No public proof-of-concept code is available at time of writing.
// See GHSA-5m9j-96ff-j6qc for maintainer analysis of the GetList use-after-free.
Detection Methods for CVE-2026-86423
Indicators of Compromise
- Unexpected crashes or SIGSEGV signals originating from Perl processes that load Image::Magick.
- Core dumps referencing PerlMagick symbols such as GetList in the faulting stack frame.
- Repeated failures of image conversion jobs correlated with specific input files or parameter sets.
Detection Strategies
- Inventory hosts running PerlMagick and compare installed ImageMagick versions against 7.1.2-30 and 6.9.13-55.
- Enable core dump collection on batch processing servers and alert on aborts inside libMagickCore or libMagickPerl.
- Correlate Perl process terminations with recent input files to identify crafted payloads.
Monitoring Recommendations
- Ship syslog, journald, and application logs to a central analytics tier to track abnormal exit codes from PerlMagick workers.
- Track process crash telemetry for the perl binary when it loads ImageMagick shared libraries.
- Watch for anomalous restart patterns in job schedulers or queue workers that invoke PerlMagick.
How to Mitigate CVE-2026-86423
Immediate Actions Required
- Upgrade ImageMagick to 7.1.2-30 or later, or to 6.9.13-55 or later on the 6.9.x branch.
- Restrict which users and services can submit inputs to PerlMagick-based workflows.
- Audit Perl scripts that expose GetList behavior to untrusted callers and validate arguments before invocation.
Patch Information
The ImageMagick maintainers fixed the use-after-free in versions 7.1.2-30 and 6.9.13-55. Package updates are distributed through the ImageMagick GitHub Security Advisory GHSA-5m9j-96ff-j6qc and downstream Linux distribution repositories. Rebuild any statically linked applications against the patched libraries after upgrading.
Workarounds
- Disable or remove PerlMagick where it is not required by production workloads.
- Run ImageMagick and PerlMagick under a restricted service account with sandboxing such as systemdNoNewPrivileges and MemoryDenyWriteExecute.
- Apply automatic process supervision so PerlMagick workers restart cleanly after a crash while patches are staged.
# Verify installed ImageMagick version on Linux
magick -version | head -n 1
dpkg -l | grep -Ei 'imagemagick|perlmagick'
rpm -qa | grep -Ei 'ImageMagick|perl-Image-Magick'
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
