CVE-2026-86421: 
ImageMagick vulnerability analysis and mitigation

CVE-2026-86421 is a memory leak vulnerability in ImageMagick's MSL (Magick Scripting Language) image decoder that allows unauthenticated remote attackers to cause a denial of service by exhausting server memory. It affects ImageMagick versions before 7.1.2-30 (7.x branch) and before 6.9.13-55 (6.x branch). The vulnerability was published on September 7, 2026, with the underlying security advisory (GHSA-4jv7-q6xw-6f4x) credited to reporter Yanhaoxi. It carries a CVSS v3.1 base score of 3.7 (Low) and a CVSS v4.0 base score of 6.3 (Medium) (GitHub Advisory, ImageMagick Advisory).

The root cause is classified under CWE-400 (Uncontrolled Resource Consumption) and CWE-401 (Missing Release of Memory after Effective Lifetime), reflecting a failure to properly deallocate memory allocated during MSL image decoding. When ImageMagick processes a specially crafted MSL image file, the decoder allocates memory that is never freed, causing cumulative memory exhaustion over repeated requests. Exploitation requires no authentication or user interaction, though the high attack complexity rating indicates that specific conditions or repeated submissions may be necessary to trigger meaningful impact (ImageMagick Advisory, GitHub Advisory).

Successful exploitation results in a denial of service condition, as the ImageMagick process progressively exhausts available system memory, potentially rendering the service unresponsive. There is no impact to confidentiality or data integrity — the vulnerability is limited to availability. Applications that accept user-supplied image files and process them with ImageMagick (e.g., web upload services, image conversion pipelines) are most at risk, as repeated submission of crafted MSL files could degrade or crash the hosting service (GitHub Advisory, ImageMagick Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time (GitHub Advisory). The EPSS score is 0.0, indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported.

1. Identify target: Locate a service that accepts image uploads and processes them with a vulnerable version of ImageMagick (before 7.1.2-30 or 6.9.13-55), such as a web application with image conversion or thumbnail generation functionality.
2. Craft malicious MSL file: Construct a specially crafted MSL image file designed to trigger repeated memory allocations within ImageMagick's MSL decoder without triggering corresponding deallocations.
3. Submit crafted file: Upload or submit the crafted MSL file to the target service repeatedly, either through a web form, API endpoint, or any interface that passes the file to ImageMagick for processing.
4. Exhaust memory: Each processing request leaks memory; repeated submissions progressively consume available system memory, eventually causing the ImageMagick process or the hosting service to become unresponsive or crash, achieving denial of service (ImageMagick Advisory).

• Process Behavior: Steadily increasing memory consumption by ImageMagick worker processes (convert, magick, or application-embedded ImageMagick calls) without corresponding release over time.
• Logs: Application or web server logs showing repeated image processing requests involving MSL-format files from the same or rotating source IPs; error logs indicating out-of-memory conditions or ImageMagick process crashes.
• System: System-level alerts for high memory utilization or OOM (Out of Memory) killer events targeting ImageMagick-related processes; sudden service unavailability correlated with image upload activity.
• Network: High volume of image upload requests (particularly .msl files or files with MSL content) from a single source or distributed sources in a short time window.

Update ImageMagick to version 7.1.2-30 or later (7.x branch) or 6.9.13-55 or later (6.x branch), which contain the fix for this memory leak (ImageMagick Advisory). As interim mitigations, implement input validation to reject or sanitize MSL image files from untrusted sources before they reach ImageMagick. Additionally, consider applying rate limiting to image processing endpoints and configuring memory limits (e.g., via ImageMagick's policy.xml) to cap resource consumption per process.