CVE-2026-86420: ImageMagick Memory Exhaustion DoS Vulnerability

CVE-2026-86420 Overview

CVE-2026-86420 affects ImageMagick, a widely deployed image processing library used in web applications, content delivery pipelines, and server-side image conversion services. The vulnerability resides in the OpenPixelCache function, which fails to properly lower the memory budget when an internal operation fails. An attacker who can submit crafted images to a target application can trigger repeated allocation failures, progressively exhausting the process memory budget and causing a denial of service. The flaw is tracked under CWE-400: Uncontrolled Resource Consumption and impacts ImageMagick versions before 7.1.2-30 and before 6.9.13-55.

Critical Impact
Remote, unauthenticated attackers can exhaust ImageMagick process memory through repeated malformed image submissions, disrupting availability of any service that processes untrusted images.

Affected Products

ImageMagick versions prior to 7.1.2-30
ImageMagick 6.x versions prior to 6.9.13-55
Applications and services that use ImageMagick to process untrusted image input

Discovery Timeline

2026-09-07 - CVE-2026-86420 published to NVD
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-86420

Vulnerability Analysis

ImageMagick maintains a per-process memory budget that governs how much memory pixel cache operations may consume. The OpenPixelCache routine allocates and initializes cache structures used to hold decoded pixel data during image processing. When an allocation or initialization step inside OpenPixelCache fails, the code path does not correctly restore or decrement the memory budget counter. Each failed operation therefore leaves the budget in an inconsistent state.

Repeated failures accumulate, driving the accounted memory usage upward until subsequent legitimate allocations are refused. The result is a denial of service against the ImageMagick process and any application that depends on it, without any authentication or user interaction required.

Root Cause

The root cause is missing cleanup logic on the error path of OpenPixelCache. The memory budget accounting is updated on allocation but not consistently reversed when a failure occurs partway through cache initialization. This is a resource management defect classified under [CWE-400].

Attack Vector

Exploitation requires the ability to submit images to a service that invokes ImageMagick. An attacker uploads or supplies a series of crafted images engineered to trigger failures inside OpenPixelCache. Each triggered failure erodes the available memory budget. After enough iterations, ImageMagick refuses further pixel cache allocations, and the hosting service can no longer process legitimate image workloads.

Refer to the GitHub Security Advisory GHSA-4mwf-mggw-29vp and the VulnCheck Advisory for ImageMagick for additional technical context.

Detection Methods for CVE-2026-86420

Indicators of Compromise

Repeated ImageMagick log entries reporting cache resources exhausted or memory allocation failures.
Elevated rates of failed image conversion requests originating from a small set of source IP addresses.
Sustained high resident memory usage in ImageMagick worker processes despite low request volume.

Detection Strategies

Instrument image processing services to record ImageMagick error codes and correlate them with the submitting client identity.
Alert when the ratio of failed to successful image operations exceeds a defined baseline threshold within a short time window.
Inventory ImageMagick installations across servers and container images to identify versions prior to 7.1.2-30 or 6.9.13-55.

Monitoring Recommendations

Monitor per-process memory metrics for ImageMagick workers and trigger alerts on sustained growth without proportional workload.
Track upload endpoints that accept images for anomalous submission patterns such as bursts of small malformed files.
Forward ImageMagick and web application logs to a centralized analytics platform for correlation and retention.

How to Mitigate CVE-2026-86420

Immediate Actions Required

Upgrade ImageMagick to version 7.1.2-30 or later, or 6.9.13-55 or later for 6.x deployments.
Rebuild container images and application bundles that embed ImageMagick and redeploy affected services.
Apply rate limiting on endpoints that accept user-supplied images to reduce the impact of repeated failure attempts.

Patch Information

The ImageMagick maintainers have released fixed versions 7.1.2-30 and 6.9.13-55. Details of the fix are published in the GitHub Security Advisory GHSA-4mwf-mggw-29vp. Package maintainers for Linux distributions will typically ship backported patches; verify the installed version against the distribution advisory before considering the system remediated.

Workarounds

Constrain ImageMagick resource limits in policy.xml to cap memory, map, and disk usage per operation.
Isolate image processing in short-lived worker processes or containers that recycle after a fixed number of jobs.
Validate and reject malformed image inputs at the application layer before invoking ImageMagick.

bash

# Example policy.xml resource caps to limit blast radius
<policymap>
  <policy domain="resource" name="memory" value="256MiB"/>
  <policy domain="resource" name="map" value="512MiB"/>
  <policy domain="resource" name="disk" value="1GiB"/>
  <policy domain="resource" name="time" value="30"/>
</policymap>