CVE-2026-93587: 
ImageMagick vulnerability analysis and mitigation

CVE-2026-93587 is a policy bypass vulnerability in ImageMagick affecting the PCD, CUBE, and HALD image coders. When a specific command line option is supplied, the decoder skips checking a configured resource limit, allowing extra memory allocation beyond the intended policy. The vulnerability affects ImageMagick versions before 7.1.2-31 (7.x branch) and before 6.9.13-56 (6.9.x branch). It was published on September 18, 2026, with a CVSS v3.1 base score of 3.3 (Low) and a CVSS v4.0 base score of 4.8 (Medium) (GitHub Advisory, GitHub Advisory DB).

The root cause is classified as CWE-400 (Uncontrolled Resource Consumption) and CWE-770 (Allocation of Resources Without Limits or Throttling). When a specific command line option is passed to ImageMagick, the PCD (Photo CD), CUBE, and HALD coders bypass the configured memory resource limit check, resulting in uncontrolled memory allocation. Exploitation requires local access and low privileges — the attacker must be able to supply command line arguments to the ImageMagick process. No public proof-of-concept code has been identified (GitHub Advisory, GitHub Advisory DB).

Successful exploitation results in a limited availability impact: a local user can cause ImageMagick to allocate more memory than the configured policy permits, potentially degrading system performance or causing the process to consume excessive resources. There is no impact on confidentiality or data integrity, and the scope is limited to the vulnerable system without lateral movement potential. The overall risk is low, as exploitation is constrained to local users with command line access (GitHub Advisory).

There is no evidence of active in-the-wild exploitation, no public proof-of-concept, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is 0.0, reflecting negligible probability of exploitation in the near term. Exploitation is non-automatable and requires local access with low privileges, significantly limiting the attacker pool (GitHub Advisory DB).

Upgrade ImageMagick to version 7.1.2-31 or later (for the 7.x branch) or 6.9.13-56 or later (for the 6.9.x branch), where the resource limit check has been restored in the affected coders. As a workaround, restrict local user access to ImageMagick command-line execution, or implement OS-level process memory limits (e.g., via cgroups or ulimit) to cap memory consumption regardless of ImageMagick's internal policy (GitHub Advisory, GitHub Advisory DB).

The vulnerability was reported by researcher Yanhaoxi and disclosed by ImageMagick maintainer dlemstra via the official GitHub Security Advisory on September 3, 2026. No significant broader media coverage or notable community commentary has been identified, consistent with the low severity rating (GitHub Advisory).