Denial of Service in ImageMagick Affects Multiple Versions
CVE-2026-86420

6.3MEDIUM

Key Information:

Vendor

Imagemagick
Status
Imagemagick
Vendor
CVE Published:
7 September 2026

What is CVE-2026-86420?

ImageMagick versions prior to 7.1.2-30 and 6.9.13-55 exhibit a vulnerability whereby improper management of memory allocation can lead to a denial of service. Specifically, when an operation within OpenPixelCache fails, the system does not adequately lower the memory budget, allowing repeated failure triggers to ultimately exhaust the available memory. This vulnerability can be exploited to disrupt services dependent on ImageMagick, potentially leading to application crashes and unavailability.

Affected Version(s)

ImageMagick 0 < 7.1.2-30

ImageMagick 0 < 6.9.13-55

ImageMagick 7.1.2-30

References

https://github.com/ImageMagick/ImageMagick/security/advis...
vendor-advisory
https://www.vulncheck.com/advisories/imagemagick-before-7...
third-party-advisory

CVSS V4

Score:
6.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
High
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Yanhaoxi
.