CVE-2026-86421: ImageMagick Memory Leak DoS Vulnerability

CVE-2026-86421 Overview

CVE-2026-86421 is a memory leak vulnerability in ImageMagick affecting versions prior to 7.1.2-30 and 6.9.13-55. The flaw resides in the Magick Scripting Language (MSL) image decoder, which allocates memory without releasing it when processing crafted MSL images. An attacker can submit a specially crafted MSL image to trigger repeated allocations, exhausting available memory and causing a denial of service on the host process.

The issue is classified under [CWE-400] Uncontrolled Resource Consumption. Because ImageMagick is widely embedded in web applications, image conversion pipelines, and document processing services, remote attackers can reach the vulnerable decoder without authentication in many deployments.

Critical Impact
Remote unauthenticated attackers can exhaust process memory in services that decode untrusted MSL images, degrading or crashing image processing workloads.

Affected Products

ImageMagick versions prior to 7.1.2-30
ImageMagick 6.x versions prior to 6.9.13-55
Applications and services embedding vulnerable ImageMagick builds for image conversion

Discovery Timeline

2026-09-07 - CVE-2026-86421 published to the National Vulnerability Database (NVD)
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-86421

Vulnerability Analysis

ImageMagick supports the Magick Scripting Language (MSL), an XML-based format that describes image processing operations. The MSL decoder parses these scripts and instantiates image objects to execute the described operations. In vulnerable versions, the decoder allocates memory for image resources during parsing but fails to free those allocations along certain code paths.

An attacker who submits a crafted MSL file to an application that invokes ImageMagick can trigger repeated allocation without matching deallocation. Over multiple requests, the process memory footprint grows until the operating system terminates the process or the host exhausts available memory.

Root Cause

The root cause is missing release logic in the MSL image decoder. Specific parsing branches allocate Image structures or associated buffers but do not invoke the corresponding destroy routines when the parser exits those branches. This maps directly to [CWE-400] Uncontrolled Resource Consumption.

Attack Vector

Exploitation requires the attacker to supply an MSL-formatted image to a service that decodes it with a vulnerable ImageMagick build. Attack complexity is elevated because many hardened deployments disable the MSL coder by policy. Where MSL remains enabled, no authentication or user interaction is required. Detailed technical analysis is available in the Vulncheck ImageMagick Memory Leak Advisory and the GitHub Security Advisory GHSA-4jv7-q6xw-6f4x.

Detection Methods for CVE-2026-86421

Indicators of Compromise

Sustained memory growth in processes running convert, magick, or applications linked against libMagickCore
Uploaded files with .msl extensions or content beginning with <?xml followed by <image> MSL tags
Repeated OOM-killer events targeting image processing workers

Detection Strategies

Inventory ImageMagick installations and compare versions against 7.1.2-30 and 6.9.13-55 baselines
Inspect policy.xml to verify whether the MSL coder is enabled and reachable from untrusted input paths
Correlate spikes in memory usage on image processing hosts with inbound requests carrying MSL or auto-detected image payloads

Monitoring Recommendations

Alert on resident set size (RSS) growth exceeding baseline thresholds for image conversion workers
Log all file types processed by ImageMagick and flag MSL submissions from external sources
Monitor dmesg and system logs for OOM events tied to ImageMagick worker processes

How to Mitigate CVE-2026-86421

Immediate Actions Required

Upgrade ImageMagick to version 7.1.2-30 or later, or to 6.9.13-55 for the 6.x branch
Disable the MSL coder in policy.xml if the format is not required by the application
Enforce resource limits on ImageMagick worker processes using cgroups or ulimit

Patch Information

Upstream fixes are published in the GitHub Security Advisory GHSA-4jv7-q6xw-6f4x. Rebuild any statically linked applications after upgrading, and redeploy container images that bundle ImageMagick to ensure the patched libraries are in use.

Workarounds

Add <policy domain="coder" rights="none" pattern="MSL" /> to policy.xml to block MSL decoding
Restrict accepted input MIME types at the application layer to formats actually required by users
Apply per-request memory and CPU limits so a single malicious image cannot exhaust host resources

bash

# Configuration example: disable the MSL coder in ImageMagick policy.xml
# Typical path: /etc/ImageMagick-7/policy.xml or /etc/ImageMagick-6/policy.xml
<policymap>
  <policy domain="coder" rights="none" pattern="MSL" />
  <policy domain="coder" rights="none" pattern="MSVG" />
  <policy domain="resource" name="memory" value="256MiB" />
  <policy domain="resource" name="map" value="512MiB" />
</policymap>