CVE-2026-93590: imagemagick Uncontrolled Resource Consumption
Vulnerability summary
CVE-2026-93590 is a high (CVSS 7.5) Uncontrolled Resource Consumption vulnerability in imagemagick. EPSS estimates a 0.39% chance of exploitation in the next 30 days, higher than 31.5% of scored vulnerabilities.
Advisory lineage
Upstream 0 · Downstream 5 · Related 5Timeline
- 18-09-2026PublishedVulnerability first disclosed.
- 21-09-2026Last modifiedVulnerability information updated.
Description
ImageMagick before 7.1.2-31 contains a policy bypass vulnerability in the UHDR encoder that fails to perform policy checks during buffer allocation for image pixels. Attackers can bypass resource policies by processing specially crafted UHDR images, potentially causing denial of service through excessive memory allocation.
CVSS metrics
8 scores · 5 sources · 2 versions- OSV · UbuntuEcosystem advisory · calculated6.3MediumCVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
- OSV · DebianEcosystem advisory · calculated6.3MediumCVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
- NVDNIST6.3MediumCVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
- OSV · ChainguardEcosystem advisory · calculated6.3MediumCVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
- CVE.orgCNA3.7LowCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:LDiffers
- OSV · UbuntuEcosystem advisory · calculated3.7LowCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:LDiffers
EPSS trend
Probability
0.39%
Chance of exploitation in the next 30 days
Percentile
32%
Versus all other CVEs
30-day change
+0.08 pp
From 0.31% on 21-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Chainguard1 product
- imagemagick-6All versions (No fix recorded)
Debian1 product
- imagemagickAll versions (No fix recorded) | < 8:7.1.2.31+dfsg1-1
Imagemagick1 product
- imagemagick< 7.1.2-31
Ubuntu1 product
- imagemagick< 8:7.1.2.18+dfsg1-1ubuntu0.1~esm4
4 vendors · 4 products
References
8 links- github.com/ImageMagick/ImageMagick/security/advisories/GHSA-7hjx-392p-f8cmVendor AdvisoryREPORTAdvisory
- www.vulncheck.com/advisories/imagemagick-before-7.1.2-31-policy-bypass-in-uhdr-encoderThird Party AdvisoryREPORTAdvisory
