CVE-2026-93589 in ImageMagick
Summary
by MITRE • 09/18/2026
ImageMagick before 7.1.2-31 and 6.9.13-56 contains a division-by-zero flaw in the FLIF encoder. An incorrect value for ticks per second in the image being encoded causes a divide-by-zero and crashes the encoder, resulting in a denial of service. The issue is fixed in 7.1.2-31 and 6.9.13-56.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 09/18/2026
The vulnerability identified as CVE-2024-xxxx involves a critical arithmetic error within the FLIF (Free Lossless Image Format) encoder component of ImageMagick, specifically affecting versions prior to 7.1.2-31 and 6.9.13-56. This flaw manifests when the software processes image metadata containing an incorrect or malformed value for ticks per second. The FLIF encoder relies on this parameter to calculate timing-related metrics during the encoding process. When a zero or near-zero value is encountered, the internal logic attempts to perform a division operation using this invalid denominator. In standard arithmetic and programming contexts, dividing by zero results in undefined behavior, which typically triggers an immediate termination of the executing thread or process due to a hardware exception or software signal such as SIGFPE on Unix-like systems.
From a technical perspective, this issue is classified under CWE-369, known as Divide By Zero. This category of weakness occurs when a mathematical division operation uses zero as its divisor without proper validation checks in place before the calculation. In the context of ImageMagick, which serves as a robust toolkit for creating, editing, and converting bitmap images, the lack of input sanitization regarding temporal metadata fields allows an attacker to craft a malicious image file that triggers this condition upon processing. The vulnerability is not limited to local execution; if ImageMagick is deployed in a server-side environment where it processes user-uploaded images or parses external image sources automatically, this flaw can be exploited remotely without authentication.
The operational impact of this vulnerability is primarily centered on availability rather than confidentiality or integrity. Because the division-by-zero error causes an immediate crash of the encoder process, it leads to a denial-of-service condition for any service relying on ImageMagick for real-time image processing. In web applications that utilize ImageMagick via bindings such as RMagick or MiniMagick, this can result in worker thread exhaustion if the application attempts to restart the crashed process repeatedly, potentially leading to broader system instability. This aligns with ATT&CK technique T1499, Endpoint Denial of Service, where an adversary disrupts access to an asset by targeting its availability through resource consumption or crashes.
Mitigation strategies for this vulnerability are straightforward and rely on software updates. Organizations running affected versions must upgrade ImageMagick to version 7.1.2-31 or later, or version 6.9.13-56 or later, where the developers have implemented proper validation checks to ensure that divisor values are non-zero before performing arithmetic operations. For environments unable to immediately patch due to dependency constraints, implementing input filtering at the application layer can provide a temporary workaround by rejecting image files with suspicious metadata structures. Additionally, deploying Web Application Firewalls (WAFs) or intrusion detection systems capable of identifying anomalous behavior patterns associated with process crashes may help in detecting exploitation attempts in real-time while longer-term remediation plans are executed.