CVE-2026-93589: 
ImageMagick vulnerability analysis and mitigation

CVE-2026-93589 is a division-by-zero vulnerability in the FLIF encoder of ImageMagick, classified as Low/Moderate severity. It affects ImageMagick versions before 7.1.2-31 (7.x branch) and before 6.9.13-56 (6.9.x branch). An attacker can supply a crafted image file with an incorrect ticks-per-second value, triggering a divide-by-zero condition that crashes the encoder and results in denial of service. The vulnerability was published on September 18, 2026, with patches available in versions 7.1.2-31 and 6.9.13-56. It carries a CVSS v3.1 base score of 3.7 (Low) and a CVSS v4.0 base score of 6.3 (Medium) (GitHub Advisory, ImageMagick Advisory).

The root cause is a missing or insufficient zero-check before a division operation in ImageMagick's FLIF encoder, classified as CWE-369 (Divide By Zero). When an image file contains an invalid or zero value for the ticks-per-second field, the encoder performs an unchecked division using that value, causing a crash. The attack vector is network-based with high attack complexity and requires no privileges or user interaction, though specific deployment conditions (attack requirements) must be present for exploitation. The vulnerability was reported by researcher 'santhreal' and disclosed via the ImageMagick GitHub security advisory (ImageMagick Advisory, GitHub Advisory).

Successful exploitation results in a crash of the ImageMagick FLIF encoder, causing a denial of service for any application or service relying on ImageMagick for FLIF image processing. There is no impact on confidentiality or integrity — only availability is affected, and only at a low level (the encoder process crashes rather than the entire host). Lateral movement and data exfiltration are not applicable to this vulnerability (GitHub Advisory, ImageMagick Advisory).

There is no known public proof-of-concept exploit and no evidence of in-the-wild exploitation at the time of disclosure (Feedly). The EPSS score is 0.0, indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. NVD's SSVC assessment also confirms exploitation status as 'none' and technical impact as 'partial' (GitHub Advisory).

1. Craft a malicious FLIF image: Create or modify a FLIF-format image file to include an invalid or zero value in the ticks-per-second metadata field.
2. Deliver the image to the target: Submit the crafted image to any service or application that uses ImageMagick (before 7.1.2-31 or 6.9.13-56) to process or encode FLIF images — for example, via a file upload endpoint or image conversion API.
3. Trigger the FLIF encoder: Cause the application to invoke ImageMagick's FLIF encoder on the malicious image, either directly or through a conversion pipeline.
4. Achieve denial of service: The encoder performs an unchecked division by the zero/invalid ticks-per-second value, triggering a crash and disrupting the image processing service (ImageMagick Advisory).

• Logs: Application or system logs showing unexpected crashes or segmentation faults in ImageMagick processes (e.g., convert, magick) when processing FLIF files; error messages referencing division-by-zero or floating-point exceptions in ImageMagick logs.
• File System: Presence of unusual or malformed FLIF image files in upload directories or temporary processing folders with anomalous metadata values.
• Process: Repeated abnormal termination of ImageMagick worker processes; core dump files generated by the ImageMagick encoder process in the working directory.

Upgrade ImageMagick to version 7.1.2-31 or later for the 7.x branch, or 6.9.13-56 or later for the 6.9.x branch, where the divide-by-zero flaw has been patched (ImageMagick Advisory). If immediate patching is not feasible, consider restricting access to FLIF encoding functionality or implementing input validation to reject image files with invalid ticks-per-second values before they reach the encoder. Limiting exposure of ImageMagick-based services to trusted users or networks can further reduce risk.