PatchTheCVECVE-2026-93590: ImageMagick before 7.1.2-31 contains a policy bypass vulnerability in the UHDR encoder that fails to perform p
CVE-2026-93590 is a low-severity flaw (CVSS 3.7) affecting imagemagick. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
ImageMagick before 7.1.2-31 contains a policy bypass vulnerability in the UHDR encoder that fails to perform policy checks during buffer allocation for image pixels. Attackers can bypass resource policies by processing specially crafted UHDR images, potentially causing denial of service through excessive memory allocation.
Why this priority
- Remotely exploitable, no login, no user action
A fixed release or distro patch exists.
Risk facts
| CVSS score | 3.7 (Low) |
| Attack vector | Network (remote) |
| Attack complexity | High |
| Privileges needed | None |
| User interaction | None |
| EPSS exploit chance | 0.4% (top 67%) |
| CISA exploited list | No |
| Weakness | CWE-400 |
| Published | 2026-09-18 |
| Last modified | 2026-10-16 |
Last updated 2026-10-16 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2026-93590?
imagemagick: upgrade to 7.1.2-31. Exact commands for each OS are on this page.
Is CVE-2026-93590 being exploited?
CVE-2026-93590 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2026-93590 affect?
CVE-2026-93590 affects imagemagick. Severity is low (CVSS 3.7). ImageMagick before 7.1.2-31 contains a policy bypass vulnerability in the UHDR encoder that fails to perform policy checks during buffer allocation for image pixels. Attackers can bypass resource policies by processing specially crafted UHD
How urgent is CVE-2026-93590?
Priority 26/100. Remotely exploitable, no login, no user action
Software pages
Related CVEs
- CVE-2026-56371 MEDIUM 5.3 UPGRADE ImageMagick before 7.1.2-15 and 6.9.13-40 contains a memory leak in coders/txt.c when processing TXT files wit
- CVE-2026-56368 LOW 3.7 UPGRADE ImageMagick before 7.1.2-15 contains a memory leak vulnerability in multiple coders that write raw pixel data
- CVE-2026-56376 LOW 3.7 UPGRADE ImageMagick before 7.1.2-15 and 6.9.13-40 contains a heap use-after-free in the meta coder: when memory alloca
- CVE-2026-56374 LOW 3.3 UPGRADE ImageMagick before 7.1.2-19 contains a heap buffer overflow vulnerability in the FTXT encoder due to missing b
- CVE-2026-56365 LOW 3.7 UPGRADE ImageMagick before 7.1.2-19 contains a memory leak vulnerability in the PNG encoder when writing MNG images