CVE-2026-86423: 
ImageMagick vulnerability analysis and mitigation

CVE-2026-86423 is a heap-use-after-free vulnerability in the GetList method of PerlMagick, the Perl interface to ImageMagick. It affects ImageMagick versions before 7.1.2-30 and 6.9.x versions before 6.9.13-55. A crafted call to the GetList method can trigger the use-after-free condition, resulting in a crash (denial of service). The vulnerability was published on September 7, 2026, with a CVSS v3.1 base score of 3.3 (Low) and a CVSS v4.0 base score of 4.8 (Medium) (GitHub Advisory, ImageMagick Advisory).

The vulnerability is classified as CWE-416 (Use After Free), occurring in the GetList method within PerlMagick, the Perl binding layer of ImageMagick (GitHub Advisory). When memory is freed and subsequently referenced by the GetList method, a crafted call can cause the program to access that freed memory region, leading to a crash. Exploitation requires local access and user interaction — an attacker must be able to invoke the GetList method with a specially crafted argument. The vulnerability was reported by security researcher Sicks3c (ImageMagick Advisory).

Successful exploitation results in a crash of the ImageMagick process (denial of service), with no impact on confidentiality or data integrity. The scope is limited to the vulnerable system itself, with no lateral movement potential or data exposure risk. Because the attack vector is local and requires user interaction, the practical impact is constrained to disrupting image processing workflows that rely on PerlMagick's GetList method (ImageMagick Advisory, GitHub Advisory).

There is no known public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time (GitHub Advisory). The EPSS score is 0.0, reflecting a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported.

Users should upgrade ImageMagick to version 7.1.2-30 or later, or for the 6.9.x branch, upgrade to version 6.9.13-55 or later (ImageMagick Advisory). As a temporary workaround, restrict local access to systems running vulnerable versions and limit user interaction with PerlMagick's GetList method. Organizations that do not use PerlMagick functionality can consider disabling or removing the Perl bindings until a patch can be applied.