CVE-2026-86421

ImageMagick before 7.1.2-30 and 6.9.13-55 contains a memory leak in the MSL image decoder. A crafted MSL image triggers memory allocation without proper deallocation, allowing an attacker to exhaust memory and cause a denial of service.

Scoring

Severity

MEDIUM

CVSS base score

6.3

CVSS vector

CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

EPSS probability

0.34%

CWE

CWE-400

Published

2026-09-07

Last modified

2026-09-08

Affected products

• ImageMagick ImageMagick
• ImageMagick ImageMagick
• ImageMagick ImageMagick

Weakness type

• CWE-400

Related vulnerabilities

• CVE-2026-88290 — GV-LPC2011/LPC2211 - Unauthenticated VLSVR Slowloris and Memory Resource Exhaustion
• CVE-2026-88286 — GV-LPC2011/LPC2211 - PTZ Connection-State Accept-Loop Denial of Service
• CVE-2026-22591 — Fast DDS DDSSQLFilter Recursive Parser Stack Exhaustion (Remote DoS)
• CVE-2026-86204 — PocketMine-MP before 5.39.2 Denial of Service via ModalFormResponsePacket
• CVE-2026-86201 — PocketMine-MP before 5.41.1 LogDoS via LoginPacket clientData
• CVE-2025-71418 — PocketMine-MP before 5.25.2 Denial of Service via explode
• CVE-2026-53937 — MCP Kotlin SDK's unbounded line buffer in StdioServerTransport/StdioClientTransport leads to memory exhaustion (DoS)
• CVE-2026-82001 — Acrobat Reader | Uncontrolled Resource Consumption (CWE-400)

Markdown version · Browse all CVEs