What’s Vulnerable › Vulnerabilities

CVE-2026-93590: ImageMagick before 7.1.2-31 Policy Bypass in UHDR encoder

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-09-18 · updated 2026-10-16
• Weakness: CWE-400

Description

ImageMagick before 7.1.2-31 contains a policy bypass vulnerability in the UHDR encoder that fails to perform policy checks during buffer allocation for image pixels. Attackers can bypass resource policies by processing specially crafted UHDR images, potentially causing denial of service through excessive memory allocation.

Affected products

• ImageMagick: before 7.1.2-31 — fixed in 7.1.2-31

How to fix

Upgrade to a fixed version: ImageMagick 7.1.2-31. Check the vendor advisory for mitigations.

References

• https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-7hjx-392p-f8cm
• https://www.vulncheck.com/advisories/imagemagick-before-7.1.2-31-policy-bypass-in-uhdr-encoder

Get alerted when CVE-2026-93590 or the next vulnerability affects your stack