ImageMagick before 7.1.2-30 and 6.9.x before 6.9.13-55 contains a heap-use-after-free vulnerability in the GetList method of PerlMagick. (CVE-2026-86423)

CVE-2026-86423 describes a heap-use-after-free vulnerability in the GetList method of PerlMagick within ImageMagick versions prior to 7.1.2-30 and 6.9.x prior to 6.9.13-55. A crafted call to this method can trigger the use-after-free condition, leading to a crash (denial of service). The vulnerability does not affect confidentiality or integrity but impacts availability. The CVSS 3.1 vector is AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H, reflecting local attack vector, low complexity, no privileges required, user interaction required, unchanged scope, no confidentiality or integrity impact, and high availability impact.

The vulnerability causes a denial of service through application crashes when the GetList method is called with crafted input. There is no direct impact on confidentiality or integrity. Exploitation requires local access and user interaction. No known exploits in the wild have been reported.

A fix is available in ImageMagick versions 7.1.2-30 and 6.9.13-55 and later. Users should upgrade to these or later versions to remediate the vulnerability. No vendor advisory content was provided to indicate otherwise, so patching is recommended.