CVE-2026-86421
Received Received - Intake

Memory Leak in ImageMagick MSL Decoder

Publication date: 2026-09-07

Last updated on: 2026-09-07

Assigner: VulnCheck

Description
ImageMagick before 7.1.2-30 and 6.9.13-55 contains a memory leak in the MSL image decoder. A crafted MSL image triggers memory allocation without proper deallocation, allowing an attacker to exhaust memory and cause a denial of service.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-07
Last Modified
2026-09-07
Generated
2026-09-07
AI Q&A
2026-09-07
EPSS Evaluated
N/A
NVD
CVE-2026-86421
EUVD
EUVD-2026-72379

Affected Vendors & Products

Showing 4 associated CPEs
Vendor Product Version / Range
imagemagick imagemagick to 7.1.2-30 (exc)
imagemagick imagemagick to 6.9.13-55 (exc)
image_magick image_magick to 7.1.2-30 (exc)
image_magick image_magick to 6.9.13-55 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-400 The product does not properly control the allocation and maintenance of a limited resource.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-86421 is a memory leak vulnerability in ImageMagick's MSL image decoder affecting versions before 7.1.2-30 and 6.9.13-55. A specially crafted MSL image triggers memory allocation without proper cleanup, causing memory exhaustion and potential denial of service.

Detection Guidance

To detect this vulnerability, check the installed version of ImageMagick using the command: convert --version or magick --version. If the version is below 7.1.2-30 or 6.9.13-55, the system is vulnerable. Monitor memory usage during image processing tasks for unusual spikes.

Impact Analysis

This vulnerability can cause system instability by consuming excessive memory, leading to crashes or slowdowns. It may disrupt services relying on ImageMagick for image processing, especially in automated workflows.

Compliance Impact

This vulnerability primarily causes denial of service through memory exhaustion, which may impact system availability. It does not directly affect confidentiality or integrity of data, so its impact on compliance with GDPR or HIPAA is likely minimal unless service disruption leads to secondary issues like delayed data processing or access.

Mitigation Strategies

Immediately update ImageMagick to version 7.1.2-30 or later for the 7.x branch, or 6.9.13-55 or later for the 6.x branch. If updating is not possible, disable the MSL decoder by removing or renaming the MSL configuration files in the ImageMagick configuration directory.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-86421. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart