CVE-2026-93587: ImageMagick before 7.1.2-31 Policy Bypass via PCD decoder
ImageMagick before 7.1.2-31 and before 6.9.13-56 contains a policy bypass in the PCD (and, per the upstream advisory, CUBE and HALD) coder: when a specific command line option is supplied, the decoder does not check a configured resource limit, which can result in extra memory allocation. A local user able to pass command line options to ImageMagick can therefore exceed the intended memory policy limit, causing a limited availability impact. The issue is fixed in 7.1.2-31 and 6.9.13-56.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ImageMagickto a version that resolves this vulnerability.Fixed in 7.1.2-31 - Upgrade
Upgrade
ImageMagickto a version that resolves this vulnerability.Fixed in 6.9.13-56
Event History
Frequently Asked Questions
Who is exposed to this issue?
The issue affects local users who can invoke ImageMagick with command-line options. It is relevant where ImageMagick resource limits are relied upon to constrain memory use.
What must an attacker do to exploit it?
An attacker needs the ability to pass a specific command-line option to ImageMagick while processing content through the affected decoders. The bypass is described for PCD and, according to the upstream advisory, CUBE and HALD coders.
Are configured memory limits sufficient protection on affected versions?
No. Under the specified command-line condition, the affected decoder does not check the configured resource limit, allowing memory allocation beyond the intended policy limit.
What versions contain the fix?
The issue is fixed in ImageMagick 7.1.2-31 and 6.9.13-56. Versions before those releases are affected.