ImageMagick CVE-2026-86420

Exploitation requires the ability to submit image processing requests to a service that uses an affected version of ImageMagick (before 7.1.2-30 or 6.9.13-55). The attacker must be able to repeatedly trigger an operation failure inside OpenPixelCache - this implies submitting crafted or malformed images that reliably hit the error path. The CVSS AT:P (attack prerequisites) and AC:H indicate that reliably constructing such inputs is non-trivial. No authentication is required (PR:N), but the attack is not instantaneous - accumulation of failed-budget operations is needed to exhaust the memory budget. Services without image-submission rate limiting or process memory caps are more vulnerable. There is no confidentiality, integrity, or scope-change impact; harm is limited to process-level availability degradation.

The CVSS 4.0 base score of 6.3 with vector AV:N/AC:H/AT:P/PR:N/UI:N reflects the moderate-to-nuanced risk profile: the attack is network-reachable and requires no authentication, but the high attack complexity (AC:H) and prerequisite condition (AT:P) indicate that reliably triggering the failure path inside OpenPixelCache is non-trivial. The availability impact is scored VA:L, meaning the attacker can degrade rather than immediately crash the process - sustained exploitation is required for meaningful impact. There is no KEV listing and no public proof-of-concept identified, and the EPSS signal was not provided; even a mid-sized web-hosting or image-processing operator in leszno should treat this as a scheduled patch rather than an emergency response, given the complexity requirements and low per-request impact. However, services that accept high volumes of untrusted image uploads (e.g., social media processors, document converters) face higher practical risk because the accumulation mechanic can be exercised passively across normal traffic loads with crafted images. The absence of confidentiality and integrity impact constrains the exploit utility to service disruption only.

An attacker submits a sequence of specially crafted images to a web application that passes them through ImageMagick for resizing or format conversion. Each image is designed to trigger an internal failure within OpenPixelCache - for example, by exceeding certain dimension thresholds or triggering an unsupported pixel operation - causing the memory budget to grow without being released. After a sustained series of such requests, the ImageMagick worker process exhausts its memory budget and becomes unable to process further images, resulting in application-layer denial of service.