CVE-2026-86421 is a low severity memory leak in the MSL image decoder of ImageMagick before 7.1.2-30 and 6.9.13-55. A crafted MSL file triggers allocations that are never freed, which can exhaust memory and cause denial of service. Upgrade to 7.1.2-30 or 6.9.13-55.
What's affected
ImageMagick before 7.1.2-30 on the 7.x line, and before 6.9.13-55 on the 6.x line. The patched versions are 7.1.2-30 and 6.9.13-55, according to the ImageMagick GitHub advisory.
Severity differs by source. The record and the GitHub advisory both rate this Low, at 3.7. The VulnCheck advisory rates it Medium, at 6.3 on CVSS 4.0, with a network vector and high attack complexity. The impact in every source is availability only. Neither the record nor the advisories report exploitation, and the CVE is not in CISA KEV.
How to check if you're exposed
Check the installed version and compare it with the patched releases:
magick -version
convert -version # ImageMagick 6 and older installs
dpkg -l imagemagick # Debian and Ubuntu
rpm -q ImageMagick # RHEL, Fedora, SUSE
ImageMagick also hides inside other software. Language bindings such as Wand, RMagick or Imagick for PHP load the system library, and container images often include it as a dependency of some other package. Run an image or dependency scan so you find copies outside the host package manager.
Distributions backport fixes without changing the upstream version, so check your distribution's tracker for this CVE if the version looks old.
What to do now
- Find every ImageMagick install, including those inside container images and application bundles.
- Upgrade to 7.1.2-30 or 6.9.13-55 or later, or to a distribution package that lists this CVE as fixed.
- If you process images from untrusted users, set resource limits in the ImageMagick policy file for memory, map, disk and time, which bounds the damage from any memory exhaustion bug.
- Restrict which coders may be used on untrusted input through the policy file.
- Rebuild and redeploy containers that include the library. Safeguard offers a free in-browser dependency scan at gold.safeguard.sh/scan that lists the package versions a project pulls in, which is a quick way to see whether an affected release is in your tree. Reachability analysis can then help you judge whether the vulnerable code path is actually used.
Why it matters
The weakness is uncontrolled resource consumption (CWE-400) through a memory leak. The Magick Scripting Language (MSL) decoder allocates memory while handling a crafted file and does not release it. One file leaks a little. A stream of them leaks enough to take a service down.
MSL is a scripting format, not an everyday image format, so many deployments never need it. That makes the mitigation unusually clean: if your application only handles JPEG, PNG and similar formats, disable the MSL coder in the ImageMagick policy file and the decoder is no longer reachable from untrusted uploads. Upgrading is still the right fix.
The ImageMagick advisory rates this Low at 3.7, and VulnCheck puts it at 6.3 on CVSS 4.0, but both describe availability impact only.
Quick check
Should I disable MSL?
If you do not need it, yes. Disabling unneeded coders through the policy file reduces attack surface for untrusted input, alongside the upgrade.
Is data exposed?
No. All sources describe a memory leak leading to denial of service, with no confidentiality or integrity impact.
Sources
- ImageMagick GitHub security advisory GHSA-4jv7-q6xw-6f4x
- VulnCheck advisory
- Safeguard Gold entry for CVE-2026-86421
Last reviewed: 18 October 2026.
