ImageMagick PerlMagick EUVD-2026-72383

Exploitation requires that the target environment uses the PerlMagick Perl bindings (not the base ImageMagick CLI or other language bindings) and specifically invokes the Layer method on a list of images. The attacker must be able to supply a crafted list of images that the application will pass to this method - this is a passive user-interaction condition (UI:P in CVSS 4.0), meaning a legitimate application or script must process the malicious input. Standard ImageMagick CLI deployments that do not use PerlMagick are not affected by this specific flaw. Authentication is not required from the attacker's perspective, but reaching the PerlMagick processing path may itself require submission privileges in the target application (e.g., an upload endpoint). Impact is strictly limited to a crash; code execution is not demonstrated.

Real-world risk is low. The CVSS 4.0 score of 4.8 accurately captures the limited blast radius: the attack vector is local (AV:L), user interaction is passive (a script or application must process attacker-supplied images), and the only confirmed impact is a crash (VA:L - low availability). There is no confidentiality or integrity impact. EPSS data was not provided, but the narrow impact class and absence from CISA KEV suggest opportunistic exploitation is unlikely. No public proof-of-concept exploit has been identified. The principal risk scenario is a denial of service in applications that accept and batch-process untrusted images via PerlMagick - for example, content pipelines or media processing servers using the Perl bindings. The flaw is not exploitable for code execution based on available data. Defenders running PerlMagick in internet-facing pipelines should treat this as a routine patch priority, not an emergency.

An attacker uploads or injects a crafted sequence of image files into a batch processing pipeline built on PerlMagick. When the pipeline script invokes the Layer method on this image list, the freed memory is accessed, causing the Perl interpreter or the underlying ImageMagick daemon to crash, disrupting image processing service. No public proof-of-concept exists, so active exploitation would require independent vulnerability research to reproduce.