CVE-2026-93590: 
ImageMagick vulnerability analysis and mitigation

CVE-2026-93590 is a policy bypass vulnerability in the UHDR encoder of ImageMagick that allows unauthenticated remote attackers to cause a denial of service through excessive memory allocation. The flaw affects all ImageMagick versions before 7.1.2-31, which is the first patched release. It was published on September 18, 2026, with the original security advisory (GHSA-7hjx-392p-f8cm) authored by maintainer dlemstra and credited to reporter santhreal. The vulnerability carries a CVSS v3.1 base score of 3.7 (Low) and a CVSS v4.0 base score of 6.3 (Medium) (GitHub Advisory, ImageMagick Advisory).

The root cause is classified under CWE-400 (Uncontrolled Resource Consumption) and CWE-770 (Allocation of Resources Without Limits or Throttling). Specifically, the UHDR encoder in ImageMagick fails to perform policy checks when allocating a buffer that holds all pixels of an image, meaning that ImageMagick's resource policy controls — which are intended to cap memory usage — are not consulted at this code path (ImageMagick Advisory). An attacker can exploit this by submitting a specially crafted UHDR image that triggers an oversized pixel buffer allocation, bypassing any configured memory limits. Exploitation requires high attack complexity and specific attack requirements (e.g., the target system must be processing UHDR images), but no authentication or user interaction is needed (GitHub Advisory).

Successful exploitation results in excessive memory consumption on the affected host, which can exhaust available system resources and cause service unavailability (denial of service). There is no impact to confidentiality or data integrity — the vulnerability is limited to availability of the ImageMagick service or any application that relies on it for image processing. Lateral movement and data exfiltration are not directly enabled by this vulnerability (GitHub Advisory, ImageMagick Advisory).

As of the time of disclosure, there is no public proof-of-concept exploit and no evidence of in-the-wild exploitation (GitHub Advisory). The EPSS score is 0.0, reflecting a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported.

1. Identify target: Locate a service or application that uses ImageMagick versions prior to 7.1.2-31 to process user-supplied or externally sourced UHDR images (e.g., a web application with image upload functionality).
2. Craft malicious UHDR image: Create a specially crafted UHDR image designed to trigger an extremely large pixel buffer allocation when processed by the UHDR encoder — for example, by specifying an unusually large image dimension or pixel count in the UHDR file structure.
3. Submit the image: Upload or otherwise deliver the crafted UHDR image to the target application or service so that ImageMagick processes it.
4. Trigger policy bypass: Because the UHDR encoder does not invoke ImageMagick's resource policy checks during buffer allocation, the configured memory limits are bypassed and the oversized allocation proceeds.
5. Achieve denial of service: The excessive memory allocation exhausts available system memory, causing the ImageMagick process or the hosting application to crash or become unresponsive (ImageMagick Advisory).

• Logs: Application or system logs showing ImageMagick processing UHDR image files submitted from external or untrusted sources; out-of-memory (OOM) errors or process crashes in application logs correlated with UHDR file processing.
• Process/System: Sudden spikes in memory consumption by the ImageMagick process (convert, magick, or application worker processes) coinciding with UHDR image processing; OOM killer events in system logs (e.g., Linux /var/log/syslog or dmesg entries referencing ImageMagick processes).
• File System: Presence of unexpected or anomalously large UHDR image files in upload directories or temporary processing folders.

Upgrade ImageMagick to version 7.1.2-31 or later, which includes the fix that enforces policy checks during UHDR encoder buffer allocation (ImageMagick Advisory). As a workaround, consider disabling UHDR encoding/decoding in the ImageMagick policy file (policy.xml) if UHDR support is not required for your deployment. Additionally, implement network-level or application-level controls to restrict processing of UHDR images from untrusted sources, and enforce OS-level memory limits (e.g., via ulimit or cgroups) on ImageMagick processes as a defense-in-depth measure.