VDB
CVE-2026-93590
CVE-2026-93590
PUBLISHED
CVSS 6.3 MEDIUM
Reported by VulnCheck · Published September 18, 2026
ImageMagick before 7.1.2-31 contains a policy bypass vulnerability in the UHDR encoder that fails to perform policy checks during buffer allocation for image pixels. Attackers can bypass resource policies by processing specially crafted UHDR images, potentially causing denial of service through excessive memory allocation.
Risk Scores
CVSS 4.0
6.3
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| ImageMagick | ImageMagick | 0, 7.1.2-31 |
| chainguard | imagemagick-6 | * |
| imagemagick | imagemagick | 0 |
| ImageMagick | ImageMagick | 0, 7.1.2-31 |
Timeline
- Sep 18, 2026 Coalition ESS Score
- Sep 18, 2026 CVE Published
- Sep 19, 2026 EPSS Score
- Sep 24, 2026 EPSS Score
- Sep 26, 2026 EPSS Score
- Sep 30, 2026 EPSS Score
- Oct 2, 2026 EPSS Score
- Oct 6, 2026 EPSS Score
- Oct 9, 2026 EPSS Score
- Oct 13, 2026 EPSS Score
- Oct 14, 2026 EPSS Score
- Oct 16, 2026 CVE Updated
References
- GitHub Security Advisory (GHSA-7hjx-392p-f8cm) vendor-advisory
- VulnCheck Advisory: ImageMagick before 7.1.2-31 Policy Bypass in UHDR encoder third-party-advisory