CVE-2026-86421

ImageMagick before 7.1.2-30 and 6.9.13-55 contains a memory leak in the MSL image decoder. A crafted MSL image triggers memory allocation without proper deallocation, allowing an attacker to exhaust memory and cause a denial of service.

  • Published Sep 7, 2026
  • CVSS 6.3 medium
  • 0.5% chance of exploitation in the next 30 days (EPSS)
  • A fix is available

Affected software

CVE-2026-86421 at the National Vulnerability Database