CVE-2026-86420 is a low severity denial of service in ImageMagick before 7.1.2-30 and 6.9.13-55. When an operation inside OpenPixelCache fails, the memory budget is not lowered, so repeated failures can exhaust it. The fix is ImageMagick 7.1.2-30 or 6.9.13-55, so upgrade the library wherever it runs.
What's affected
ImageMagick before 7.1.2-30 on the 7.x line, and before 6.9.13-55 on the 6.x line. The patched versions are 7.1.2-30 and 6.9.13-55, according to the ImageMagick GitHub advisory.
Severity differs by source. The record and the GitHub advisory both rate this Low, at 3.7. The VulnCheck advisory rates it Medium, at 6.3 on CVSS 4.0, with a network vector and high attack complexity. The impact in every source is availability only. Neither the record nor the advisories report exploitation, and the CVE is not in CISA KEV.
How to check if you're exposed
Check the installed version and compare it with the patched releases:
magick -version
convert -version # ImageMagick 6 and older installs
dpkg -l imagemagick # Debian and Ubuntu
rpm -q ImageMagick # RHEL, Fedora, SUSE
ImageMagick also hides inside other software. Language bindings such as Wand, RMagick or Imagick for PHP load the system library, and container images often include it as a dependency of some other package. Run an image or dependency scan so you find copies outside the host package manager.
Distributions backport fixes without changing the upstream version, so check your distribution's tracker for this CVE if the version looks old.
What to do now
- Find every ImageMagick install, including those inside container images and application bundles.
- Upgrade to 7.1.2-30 or 6.9.13-55 or later, or to a distribution package that lists this CVE as fixed.
- If you process images from untrusted users, set resource limits in the ImageMagick policy file for memory, map, disk and time, which bounds the damage from any memory exhaustion bug.
- Restrict which coders may be used on untrusted input through the policy file.
- Rebuild and redeploy containers that include the library. Safeguard offers a free in-browser dependency scan at gold.safeguard.sh/scan that lists the package versions a project pulls in, which is a quick way to see whether an affected release is in your tree. Reachability analysis can then help you judge whether the vulnerable code path is actually used.
Why it matters
The weakness is uncontrolled resource consumption (CWE-400). ImageMagick keeps a budget for how much memory a process may use for pixel data. When an allocation inside OpenPixelCache fails, the code was supposed to give back what it had reserved against that budget. It did not, so each failure left the accounting a little further off. Enough failures and the budget reads as spent even though the memory is free.
The effect is that the process then refuses or fails work it should have been able to do. For a long running service that converts images, such as a thumbnailing worker, that turns into an outage until restart. For a one shot command line run it barely matters.
That is why the severity is Low. The attacker needs to trigger failures repeatedly, and a worker that restarts on failure recovers on its own. The policy file limits are the standard defence for services that handle untrusted images.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Which versions are patched?
ImageMagick 7.1.2-30 on the 7 line and 6.9.13-55 on the 6 line.
Does this crash the whole server?
The advisories describe denial of service of the ImageMagick process by exhausting its memory budget, not a system wide crash.
Sources
- ImageMagick GitHub security advisory GHSA-4mwf-mggw-29vp
- VulnCheck advisory
- Safeguard Gold entry for CVE-2026-86420
Last reviewed: 18 October 2026.
