CVE-2026-93590: ImageMagick before 7.1.2-31 Policy Bypass in UHDR encoder
ImageMagick before 7.1.2-31 contains a policy bypass vulnerability in the UHDR encoder that fails to perform policy checks during buffer allocation for image pixels. Attackers can bypass resource policies by processing specially crafted UHDR images, potentially causing denial of service through excessive memory allocation.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Deployments using ImageMagick versions before 7.1.2-31 are affected when they process UHDR images through the vulnerable encoder. The provided information does not identify any particular operating system, package configuration, or deployment type as exempt.
What must an attacker do to exploit the vulnerability?
An attacker needs to cause ImageMagick to process a specially crafted UHDR image. No privileges or user interaction are required according to the supplied vector, but exploitation has high attack complexity.
What is the likely impact?
The issue can bypass configured resource policies during image-pixel buffer allocation, allowing excessive memory allocation and potentially causing denial of service. The supplied severity vector indicates no confidentiality or integrity impact.
What version resolves the issue?
Upgrade ImageMagick to version 7.1.2-31 or later. The affected range is versions before 7.1.2-31.