CVE-2026-86420: ImageMagick before 7.1.2-30 Denial of Service Memory Budget
ImageMagick before 7.1.2-30 and 6.9.13-55 fails to properly lower the memory budget when an operation inside OpenPixelCache fails. Repeated triggering of such failures can exhaust the process memory budget and result in a denial of service.
Affected Software
Event History
Frequently Asked Questions
What conditions are required to trigger the denial of service?
An attacker must repeatedly cause failures in operations inside OpenPixelCache. The attack is network-reachable and requires no privileges or user interaction, but has high attack complexity.
Which releases should be remediated?
ImageMagick releases before 7.1.2-30 and 6.9.13-55 are affected. Upgrade to at least the applicable listed release.
What is the expected impact if exploitation succeeds?
Repeated failures can exhaust the affected process's memory budget and cause a denial of service. The provided impact information indicates availability impact only, with no confidentiality or integrity impact.