A heap-use-after-free flaw exists in the Layer method of PerlMagick, allowing a maliciously crafted list of images to access memory after it has been freed and causing the application to terminate. According to the description, the result is a crash of the ImageMagick process, which can lead to a denial of service for any system relying on image processing. The weaknesses are typified by CWE-416 and CWE-825, which highlight improper management of dynamically allocated memory.

Vulnerable installations include ImageMagick versions prior to 7.1.2-30 and 6.9.x prior to 6.9.13-55. Systems that use PerlMagick to process image layers are at risk. The affected products are documented under the CNA vendor name ImageMagick, ImageMagick.

The CVSS score of 4.8 indicates a moderate severity, and the EPSS score is not available, while the vulnerability is not listed in the CISA KEV catalog. Because the flaw requires an attacker to provide a crafted image list that invokes the Layer method, the likelihood of exploitation depends on whether image processing is exposed to unauthenticated or external input. If such input can be supplied, an attacker could trigger the crash remotely, potentially disrupting services that rely on ImageMagick. No known workarounds are reported, so preventing exposure of the vulnerable method and applying the fix are the recommended mitigations.