CVE-2026-93588: ImageMagick before 7.1.2-31 Null Pointer Dereference via PNM
ImageMagick before 7.1.2-31 and before 6.9.13-56 contains a NULL pointer dereference in the PNM coder. When the coder reaches a memory (resource) limit at a specific point during processing, the failed allocation is not handled and a NULL pointer is dereferenced, which can lead to a denial of service (application crash) when processing a specially crafted or sufficiently large PNM image.
Affected Software
Event History
Frequently Asked Questions
Which ImageMagick releases are affected?
ImageMagick releases before 7.1.2-31 and before 6.9.13-56 are affected.
What must an attacker be able to do to trigger the crash?
An attacker needs the ability to cause ImageMagick to process a specially crafted or sufficiently large PNM image. Exploitation depends on processing reaching a resource-limit condition at a specific point, and requires low privileges.
What is the practical impact?
The issue can cause the ImageMagick process to crash, resulting in denial of service. The provided severity data indicates no confidentiality or integrity impact.
How can exposure be reduced if an update cannot be applied immediately?
Avoid processing untrusted PNM images, particularly large inputs, until ImageMagick can be updated. The vulnerable path is the PNM coder during resource-limit handling.