CVE-2026-86421: ImageMagick before 7.1.2-30 Memory Leak via MSL decoder
ImageMagick before 7.1.2-30 and 6.9.13-55 contains a memory leak in the MSL image decoder. A crafted MSL image triggers memory allocation without proper deallocation, allowing an attacker to exhaust memory and cause a denial of service.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/imagemagickto a version that resolves this vulnerability.Fixed in 8:6.9.11.60+dfsg-1.6+deb12u14 - Upgrade
Upgrade
debian/imagemagickto a version that resolves this vulnerability.Fixed in 8:7.1.1.43+dfsg1-1+deb13u13 - Upgrade
Upgrade
debian/imagemagickto a version that resolves this vulnerability.Fixed in 8:7.1.2.31+dfsg1-1 - Upgrade
Upgrade
debian/imagemagickto a version that resolves this vulnerability.Fixed in 8:6.9.11.60+dfsg-1.6+deb12u15Fixed in 8:7.1.1.43+dfsg1-1+deb13u14Fixed in 8:7.1.2.34+dfsg1-1Fixed in 8:7.1.2.35+dfsg1-2
Event History
Frequently Asked Questions
Which ImageMagick releases are affected?
ImageMagick releases before 7.1.2-30 and before 6.9.13-55 are affected. Upgrade to the stated fixed release or a later release in the applicable branch.
What must an attacker do to trigger the issue?
An attacker must cause ImageMagick to process a crafted MSL image. The issue can exhaust memory and cause a denial of service; no confidentiality or integrity impact is identified.
Which deployments are most exposed?
Deployments that use ImageMagick to process MSL images supplied through a network-accessible workflow are exposed to attempted exploitation. The provided data indicates no authentication or user interaction is required.