CVE-2026-86420: ImageMagick before 7.1.2-30 Denial of Service Memory Budget
ImageMagick before 7.1.2-30 and 6.9.13-55 fails to properly lower the memory budget when an operation inside OpenPixelCache fails. Repeated triggering of such failures can exhaust the process memory budget and result in a denial of service.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/imagemagickto a version that resolves this vulnerability.Fixed in 8:6.9.11.60+dfsg-1.6+deb12u14 - Upgrade
Upgrade
debian/imagemagickto a version that resolves this vulnerability.Fixed in 8:7.1.1.43+dfsg1-1+deb13u13 - Upgrade
Upgrade
debian/imagemagickto a version that resolves this vulnerability.Fixed in 8:7.1.2.31+dfsg1-1 - Upgrade
Upgrade
debian/imagemagickto a version that resolves this vulnerability.Fixed in 8:6.9.11.60+dfsg-1.6+deb12u15Fixed in 8:7.1.1.43+dfsg1-1+deb13u14Fixed in 8:7.1.2.34+dfsg1-1Fixed in 8:7.1.2.35+dfsg1-2
Event History
Frequently Asked Questions
What conditions are required to trigger the denial of service?
An attacker must repeatedly cause failures in operations inside OpenPixelCache. The attack is network-reachable and requires no privileges or user interaction, but has high attack complexity.
Which releases should be remediated?
ImageMagick releases before 7.1.2-30 and 6.9.13-55 are affected. Upgrade to at least the applicable listed release.
What is the expected impact if exploitation succeeds?
Repeated failures can exhaust the affected process's memory budget and cause a denial of service. The provided impact information indicates availability impact only, with no confidentiality or integrity impact.