CVE-2026-93590
ImageMagick before 7.1.2-31 Policy Bypass in UHDR encoder
- State
- Published
- Severity
- 6.3 Medium
- Published
- Sep 18, 2026
- Updated
- Sep 21, 2026
- Reserved
- Sep 18, 2026
Description
ImageMagick before 7.1.2-31 contains a policy bypass vulnerability in the UHDR encoder that fails to perform policy checks during buffer allocation for image pixels. Attackers can bypass resource policies by processing specially crafted UHDR images, potentially causing denial of service through excessive memory allocation.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 6.3 Medium | CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N | VulnCheck |
| 3.1 | 3.7 Low | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L | VulnCheck |
Weaknesses
- CWE-400 Uncontrolled Resource Consumption
Affected Products
| Product | Versions |
|---|---|
ImageMagickImageMagick |
|
References
- GitHub Security Advisory (GHSA-7hjx-392p-f8cm)vendor-advisory
- VulnCheck Advisory: ImageMagick before 7.1.2-31 Policy Bypass in UHDR encoderthird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.