ImageMagick PerlMagick CVE-2026-86423

The PerlMagick Perl binding must be installed and in use - this is not present in default ImageMagick CLI or C-library-only deployments. Application code must invoke the GetList method on an ImageMagick object with attacker-influenced input. Attack vector is local (AV:L) per the CVSS 4.0 vector, meaning the attacker must be able to supply input to a locally running PerlMagick consumer (e.g., a server-side Perl script processing uploaded files) rather than reaching a network service directly. User interaction (UI:P) is required, consistent with a user or automated job triggering the image-processing workflow. Impact is strictly availability - crash only, no memory disclosure.

The CVSS 4.0 score of 4.8 (medium) is consistent with the narrow impact: local attack vector (AV:L), user interaction required (UI:P), and only low availability impact (VA:L) with no confidentiality or integrity effect. EPSS data is not provided, and the absence of a CISA KEV listing and no mention of public exploit code confirm this is not an actively exploited issue. The real-world risk is further constrained by the PerlMagick dependency - the Perl binding must be compiled and loaded, which is not the default in most ImageMagick distributions. The vulnerability is relevant primarily to Perl-based image-processing pipelines (e.g., web applications or batch processors invoking ImageMagick via PerlMagick). Crash-only impact without memory disclosure means exploitation for code execution is not established, making this a low-priority patching item except in high-availability Perl/ImageMagick deployments.

An attacker supplying a crafted image file or argument sequence to a Perl application that calls PerlMagick's GetList method triggers the use-after-free condition, causing the Perl interpreter or hosting process to crash. In a web application that processes user-uploaded images via PerlMagick, this results in a denial-of-service condition for the processing worker. No public exploit code is available; the crash-only impact makes reliable code execution exploitation unlikely without additional research.