CVE-2026-93587 in ImageMagick
Summary
by MITRE • 09/18/2026
ImageMagick before 7.1.2-31 and before 6.9.13-56 contains a policy bypass in the PCD (and, per the upstream advisory, CUBE and HALD) coder: when a specific command line option is supplied, the decoder does not check a configured resource limit, which can result in extra memory allocation. A local user able to pass command line options to ImageMagick can therefore exceed the intended memory policy limit, causing a limited availability impact. The issue is fixed in 7.1.2-31 and 6.9.13-56.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 09/18/2026
The vulnerability identified in versions of ImageMagick prior to 7.1.2-31 for the major branch and before 6.9.13-56 for the legacy branch represents a critical failure in resource management within specific image decoding modules. This flaw is primarily associated with the PCD coder, though upstream advisories indicate that the CUBE and HALD coders are also susceptible to this policy bypass mechanism. The core technical issue stems from an inconsistency in how the application enforces configured security policies when processing images through these specific decoders. Under normal circumstances, ImageMagick relies on a robust configuration system designed to restrict resource consumption such as memory usage, disk space, and thread counts to prevent denial of service attacks or excessive resource exhaustion. However, the implementation within the PCD, CUBE, and HALD modules fails to validate input against these configured limits when certain command line options are utilized during image processing operations.
From a technical perspective, this oversight allows an attacker who has the ability to invoke ImageMagick commands with specific parameters to bypass memory policy restrictions entirely. When such a malformed or specifically crafted request is processed by the vulnerable decoder, the application allocates additional memory beyond what was defined in the security configuration file. This behavior deviates from the expected secure coding practices where resource limits should be strictly enforced regardless of the input method or command line arguments provided. The lack of validation means that an attacker can trigger unbounded memory allocation, potentially leading to significant system instability if sufficient resources are consumed by repeated exploitation attempts.
The operational impact of this vulnerability is primarily centered on availability rather than confidentiality or integrity in most local scenarios. A local user with the ability to execute commands using ImageMagick can exploit this flaw to cause a denial of service condition by exhausting available memory resources on the host system. This could result in the termination of other critical processes, system crashes, or degraded performance for all users sharing the environment. While the primary vector described involves local command line execution, it is important to note that if ImageMagick is used within web applications or server-side processing pipelines where user-supplied image data can be indirectly processed through these coders with specific flags, the attack surface may expand beyond just local privilege boundaries.
This vulnerability aligns closely with CWE-787 Out-of-bounds Write and CWE-400 Uncontrolled Resource Consumption in terms of its underlying technical nature, as it involves improper handling of resource limits leading to potential memory exhaustion. In the context of the MITRE ATT&CK framework, this behavior can be categorized under T1496 Resource Hijacking, specifically within subtechniques related to computational cycle or bandwidth consumption, although more accurately it fits into broader categories of Denial of Service via resource exhaustion such as T1499 Endpoint Denial of Service. The exploitation relies on the attacker's ability to influence system resources through legitimate application functionality that fails to sanitize input against security policies.
Mitigation strategies for this vulnerability involve immediate upgrading to patched versions, specifically ImageMagick 7.1.2-31 or later for the current major branch and version 6.9.13-56 or later for the legacy branch. These releases contain code changes that ensure resource limits are consistently checked across all supported coders including PCD, CUBE, and HALD. In environments where upgrading is not immediately feasible, administrators should review ImageMagick policy.xml configurations to restrict access to these specific coders if they are not required for business operations. Additionally, implementing strict input validation at the application layer before passing image data or command arguments to ImageMagick can provide an additional layer of defense against exploitation attempts that rely on triggering this specific code path.