ImageMagick before 7.1.2-31 and before 6.9.13-56 contains a NULL pointer dereference in the PNM coder. When the coder reaches a memory (resource) limit at a specific point during processing, the failed allocation is not handled and a NULL pointer is dereferenced, which can lead to a denial of service (application crash) when processing a specially crafted or sufficiently large PNM image.

The remote host has a version of ImageMagick installed that is prior to 6.9.13-56, or 7.x prior to 7.1.2-31. It is, therefore, affected by multiple vulnerabilities:

  - ImageMagick before 7.1.2-31 and before 6.9.13-56 contains a NULL pointer dereference in the PNM coder. When     the coder reaches a memory (resource) limit at a specific point during processing, the failed allocation is     not handled and a NULL pointer is dereferenced, which can lead to a denial of service (application crash)     when processing a specially crafted or sufficiently large PNM image. (CVE-2026-93588)

  - ImageMagick before 7.1.2-31 and before 6.9.13-56 contains a use-after-free vulnerability in the ImagesToBlob     method, caused by a pointer that is not updated correctly. Exploitation may result in a limited availability     impact (e.g., a crash of the affected process). (CVE-2026-93586)

  - ImageMagick before 7.1.2-31 and 6.9.13-56 contains a division-by-zero flaw in the FLIF encoder. An incorrect     value for ticks per second in the image being encoded causes a divide-by-zero and crashes the encoder,     resulting in a denial of service. (CVE-2026-93589)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES16 / SLES_SAP16 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:23948-1 advisory.

    - CVE-2026-93586: use-after-free in the `ImagesToBlob` method can lead to a process crash (bsc#1281912).
    - CVE-2026-93587: policy bypass in the PCD, CUBE and HALD coders can lead to extra memory allocation and a     denial of       service (bsc#1281909).
    - CVE-2026-93588: NULL pointer dereference in the PNM coder can lead to a denial of service (bsc#1281910).
    - CVE-2026-93589: division-by-zero flaw in the FLIF encoder can lead to a denial of service (bsc#1281911).
    - CVE-2026-93590: failure to perform policy checks during buffer allocation for image pixels in the UHDR     encoder can       lead to denial of service (bsc#1281913).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21973-1 advisory.

    - CVE-2026-93586: use-after-free in the `ImagesToBlob` method can lead to a process crash (bsc#1281912).
    - CVE-2026-93587: policy bypass in the PCD, CUBE and HALD coders can lead to extra memory allocation and a     denial of       service (bsc#1281909).
    - CVE-2026-93588: NULL pointer dereference in the PNM coder can lead to a denial of service (bsc#1281910).
    - CVE-2026-93589: division-by-zero flaw in the FLIF encoder can lead to a denial of service (bsc#1281911).
    - CVE-2026-93590: failure to perform policy checks during buffer allocation for image pixels in the UHDR     encoder can       lead to denial of service (bsc#1281913).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 26.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8859-1 advisory.

    It was discovered that ImageMagick did not correctly handle certain images. An attacker could possibly use     this issue to cause a denial of service or obtain sensitive information. This issue only affected Ubuntu     16.04 LTS, Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, and Ubuntu 24.04 LTS. (CVE-2026-56367)

    It was discovered that ImageMagick did not correctly handle certain images. An attacker could possibly use     this issue to cause a denial of service. (CVE-2026-93586)

    It was discovered that ImageMagick did not correctly handle certain images. A local attacker could     possibly use this issue to cause a denial of service. This issue only affected Ubuntu 20.04 LTS, Ubuntu     22.04 LTS, Ubuntu 24.04 LTS, and Ubuntu 26.04 LTS. (CVE-2026-93587, CVE-2026-93588)

    It was discovered that ImageMagick did not correctly handle certain images. An attacker could possibly use     this issue to cause a denial of service. This issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS,     Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, and Ubuntu 26.04 LTS. (CVE-2026-93589)

    It was discovered that ImageMagick did not correctly handle certain images. An attacker could possibly use     this issue to cause a denial of service. This issue only affected Ubuntu 26.04 LTS. (CVE-2026-93590)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1790181280 advisory.

  - ImageMagick before 7.1.2-31 and before 6.9.13-56 contains a use-after-free vulnerability in the     ImagesToBlob method, caused by a pointer that is not updated correctly. Exploitation may result in a     limited availability impact (e.g., a crash of the affected process). The issue is fixed in versions     7.1.2-31 and 6.9.13-56. (CVE-2026-93586)

  - ImageMagick before 7.1.2-31 and before 6.9.13-56 contains a policy bypass in the PCD (and, per the     upstream advisory, CUBE and HALD) coder: when a specific command line option is supplied, the decoder does     not check a configured resource limit, which can result in extra memory allocation. A local user able to     pass command line options to ImageMagick can therefore exceed the intended memory policy limit, causing a     limited availability impact. The issue is fixed in 7.1.2-31 and 6.9.13-56. (CVE-2026-93587)

  - ImageMagick before 7.1.2-31 and before 6.9.13-56 contains a NULL pointer dereference in the PNM coder.
    When the coder reaches a memory (resource) limit at a specific point during processing, the failed     allocation is not handled and a NULL pointer is dereferenced, which can lead to a denial of service     (application crash) when processing a specially crafted or sufficiently large PNM image. (CVE-2026-93588)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Rocky Linux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1790182513 advisory.

  - ImageMagick is free and open-source software used for editing and manipulating digital images. Versions     prior to 7.1.2-0 and 6.9.13-26 have a heap buffer overflow in the `InterpretImageFilename` function. The     issue stems from an off-by-one error that causes out-of-bounds memory access when processing format     strings containing consecutive percent signs (`%%`). Versions 7.1.2-0 and 6.9.13-26 fix the issue.
    (CVE-2025-53014)

  - ImageMagick is free and open-source software used for editing and manipulating digital images. In versions     prior to 7.1.2-0 and 6.9.13-26, in ImageMagick's `magick stream` command, specifying multiple consecutive     `%d` format specifiers in a filename template causes a memory leak. Versions 7.1.2-0 and 6.9.13-26 fix the     issue. (CVE-2025-53019)

  - ImageMagick is free and open-source software used for editing and manipulating digital images. In versions     prior to 7.1.2-0 and 6.9.13-26, in ImageMagick's `magick mogrify` command, specifying multiple consecutive     `%d` format specifiers in a filename template causes internal pointer arithmetic to generate an address     below the beginning of the stack buffer, resulting in a stack overflow through `vsnprintf()`. Versions     7.1.2-0 and 6.9.13-26 fix the issue. (CVE-2025-53101)

  - ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to     versions 6.9.13-27 and 7.1.2-1, there is undefined behavior (function-type-mismatch) in splay tree cloning     callback. This results in a deterministic abort under UBSan (DoS in sanitizer builds), with no crash in a     non-sanitized build. This issue has been patched in versions 6.9.13-27 and 7.1.2-1. (CVE-2025-55160)

  - ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to     versions 6.9.13-28 and 7.1.2-2, passing a geometry string containing only a colon (:) to montage
    -geometry leads GetGeometry() to set width/height to 0. Later, ThumbnailImage() divides by these zero     dimensions, triggering a crash (SIGFPE/abort), resulting in a denial of service. This issue has been     patched in versions 6.9.13-28 and 7.1.2-2. (CVE-2025-55212)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The AlmaLinux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1790182513 advisory.

  - ImageMagick is free and open-source software used for editing and manipulating digital images. Versions     prior to 7.1.2-0 and 6.9.13-26 have a heap buffer overflow in the `InterpretImageFilename` function. The     issue stems from an off-by-one error that causes out-of-bounds memory access when processing format     strings containing consecutive percent signs (`%%`). Versions 7.1.2-0 and 6.9.13-26 fix the issue.
    (CVE-2025-53014)

  - ImageMagick is free and open-source software used for editing and manipulating digital images. In versions     prior to 7.1.2-0 and 6.9.13-26, in ImageMagick's `magick stream` command, specifying multiple consecutive     `%d` format specifiers in a filename template causes a memory leak. Versions 7.1.2-0 and 6.9.13-26 fix the     issue. (CVE-2025-53019)

  - ImageMagick is free and open-source software used for editing and manipulating digital images. In versions     prior to 7.1.2-0 and 6.9.13-26, in ImageMagick's `magick mogrify` command, specifying multiple consecutive     `%d` format specifiers in a filename template causes internal pointer arithmetic to generate an address     below the beginning of the stack buffer, resulting in a stack overflow through `vsnprintf()`. Versions     7.1.2-0 and 6.9.13-26 fix the issue. (CVE-2025-53101)

  - ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to     versions 6.9.13-27 and 7.1.2-1, there is undefined behavior (function-type-mismatch) in splay tree cloning     callback. This results in a deterministic abort under UBSan (DoS in sanitizer builds), with no crash in a     non-sanitized build. This issue has been patched in versions 6.9.13-27 and 7.1.2-1. (CVE-2025-55160)

  - ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to     versions 6.9.13-28 and 7.1.2-2, passing a geometry string containing only a colon (:) to montage
    -geometry leads GetGeometry() to set width/height to 0. Later, ThumbnailImage() divides by these zero     dimensions, triggering a crash (SIGFPE/abort), resulting in a denial of service. This issue has been     patched in versions 6.9.13-28 and 7.1.2-2. (CVE-2025-55212)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS-STREAM8:CLSA-2026:1790327628 advisory.

  - ImageMagick before 7.1.2-31 and before 6.9.13-56 contains a use-after-free vulnerability in the     ImagesToBlob method, caused by a pointer that is not updated correctly. Exploitation may result in a     limited availability impact (e.g., a crash of the affected process). The issue is fixed in versions     7.1.2-31 and 6.9.13-56. (CVE-2026-93586)

  - ImageMagick before 7.1.2-31 and before 6.9.13-56 contains a policy bypass in the PCD (and, per the     upstream advisory, CUBE and HALD) coder: when a specific command line option is supplied, the decoder does     not check a configured resource limit, which can result in extra memory allocation. A local user able to     pass command line options to ImageMagick can therefore exceed the intended memory policy limit, causing a     limited availability impact. The issue is fixed in 7.1.2-31 and 6.9.13-56. (CVE-2026-93587)

  - ImageMagick before 7.1.2-31 and before 6.9.13-56 contains a NULL pointer dereference in the PNM coder.
    When the coder reaches a memory (resource) limit at a specific point during processing, the failed     allocation is not handled and a NULL pointer is dereferenced, which can lead to a denial of service     (application crash) when processing a specially crafted or sufficiently large PNM image. (CVE-2026-93588)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The CentOS Linux 8.4 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS8.4:CLSA-2026:1790327966 advisory.

  - ImageMagick before 7.1.2-31 and before 6.9.13-56 contains a use-after-free vulnerability in the     ImagesToBlob method, caused by a pointer that is not updated correctly. Exploitation may result in a     limited availability impact (e.g., a crash of the affected process). The issue is fixed in versions     7.1.2-31 and 6.9.13-56. (CVE-2026-93586)

  - ImageMagick before 7.1.2-31 and before 6.9.13-56 contains a policy bypass in the PCD (and, per the     upstream advisory, CUBE and HALD) coder: when a specific command line option is supplied, the decoder does     not check a configured resource limit, which can result in extra memory allocation. A local user able to     pass command line options to ImageMagick can therefore exceed the intended memory policy limit, causing a     limited availability impact. The issue is fixed in 7.1.2-31 and 6.9.13-56. (CVE-2026-93587)

  - ImageMagick before 7.1.2-31 and before 6.9.13-56 contains a NULL pointer dereference in the PNM coder.
    When the coder reaches a memory (resource) limit at a specific point during processing, the failed     allocation is not handled and a NULL pointer is dereferenced, which can lead to a denial of service     (application crash) when processing a specially crafted or sufficiently large PNM image. (CVE-2026-93588)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The CentOS Linux 8.5 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS8.5:CLSA-2026:1790328174 advisory.

  - ImageMagick before 7.1.2-31 and before 6.9.13-56 contains a use-after-free vulnerability in the     ImagesToBlob method, caused by a pointer that is not updated correctly. Exploitation may result in a     limited availability impact (e.g., a crash of the affected process). The issue is fixed in versions     7.1.2-31 and 6.9.13-56. (CVE-2026-93586)

  - ImageMagick before 7.1.2-31 and before 6.9.13-56 contains a policy bypass in the PCD (and, per the     upstream advisory, CUBE and HALD) coder: when a specific command line option is supplied, the decoder does     not check a configured resource limit, which can result in extra memory allocation. A local user able to     pass command line options to ImageMagick can therefore exceed the intended memory policy limit, causing a     limited availability impact. The issue is fixed in 7.1.2-31 and 6.9.13-56. (CVE-2026-93587)

  - ImageMagick before 7.1.2-31 and before 6.9.13-56 contains a NULL pointer dereference in the PNM coder.
    When the coder reaches a memory (resource) limit at a specific point during processing, the failed     allocation is not handled and a NULL pointer is dereferenced, which can lead to a denial of service     (application crash) when processing a specially crafted or sufficiently large PNM image. (CVE-2026-93588)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4376-1 advisory.

    - CVE-2026-62343: heap buffer over-write in morphology operation when an invalid kernel is provided     (bsc#1272575).
    - CVE-2026-62363: heap buffer over-write in fx operation (bsc#1272582).
    - CVE-2026-62946: integer overflow in JNX decoder causes heap buffer over-write when processing extremly     large files on       32-bit builds (bsc#1272580).
    - CVE-2026-64685: heap buffer over-read in BGR decoder due to missing end-of-file check (bsc#1272953).
    - CVE-2026-66011: memory Leak when providing invalid options to the cli (bsc#1272577).
    - CVE-2026-86420: denial of Service due to memory budget exhaustion (bsc#1279696).
    - CVE-2026-86421: denial of Service via memory leak in MSL decoder (bsc#1279711).
    - CVE-2026-86423: denial of service via heap-use-after-free in PerlMagick's GetList method (bsc#1279794).
    - CVE-2026-86425: denial of Service due to heap-use-after-free vulnerability (bsc#1279797).
    - CVE-2026-93586: use-after-free in the `ImagesToBlob` method can lead to a process crash (bsc#1281912).
    - CVE-2026-93587: policy bypass in the PCD, CUBE and HALD coders can lead to extra memory allocation and a     denial of       service (bsc#1281909).
    - CVE-2026-93588: NULL pointer dereference in the PNM coder can lead to a denial of service (bsc#1281910).
    - CVE-2026-93589: division-by-zero flaw in the FLIF encoder can lead to a denial of service (bsc#1281911).
    - GHSA-hc76-7mpc-qjqh: code injection in HTML encoder due to incomplete fix of CVE-2026-25797     (bsc#1272579).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - ImageMagick before 7.1.2-31 and before 6.9.13-56 contains a NULL pointer dereference in the PNM coder.
    When the coder reaches a memory (resource) limit at a specific point during processing, the failed     allocation is not handled and a NULL pointer is dereferenced, which can lead to a denial of service     (application crash) when processing a specially crafted or sufficiently large PNM image. (CVE-2026-93588)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
362654	ImageMagick < 6.9.13-56 / 7.x < 7.1.2-31 Multiple Vulnerabilities	Nessus	Misc.	Local	medium
362583	SUSE SLES16: ImageMagick / ImageMagick-config-7-SUSE / etc (SUSE-SU-2026:23948-1)	Nessus	SuSE Local Security Checks	Local	medium
362523	openSUSE 16: ImageMagick / ImageMagick-config-7-SUSE / etc (openSUSE-SU-2026:21973-1)	Nessus	SuSE Local Security Checks	Local	medium
362462	Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 26.04 LTS : ImageMagick vulnerabilities (USN-8859-1)	Nessus	Ubuntu Local Security Checks	Local	medium
362164	AlmaLinux 9.2 [TuxCare] Security Update: ImageMagick / ImageMagick-c++ / ImageMagick-c++-devel / etc Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2026:1790181280)	Nessus	Alma Linux Local Security Checks	Local	medium
361701	Rocky Linux 9.6 [TuxCare] Security Update: ImageMagick / ImageMagick-c++ / ImageMagick-c++-devel / etc Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1790182513)	Nessus	Rocky Linux Local Security Checks	Local	critical
361599	AlmaLinux 9.6 [TuxCare] Security Update: ImageMagick / ImageMagick-c++ / ImageMagick-c++-devel / etc Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1790182513)	Nessus	Alma Linux Local Security Checks	Local	critical
352996	CentOS Linux 8 [TuxCare] Security Update: ImageMagick / ImageMagick-c++ / ImageMagick-c++-devel / etc Multiple Vulnerabilities (CENTOS-STREAM8:CLSA-2026:1790327628)	Nessus	CentOS Local Security Checks	Local	medium
352550	CentOS Linux 8.4 [TuxCare] Security Update: ImageMagick / ImageMagick-c++ / ImageMagick-c++-devel / etc Multiple Vulnerabilities (CENTOS8.4:CLSA-2026:1790327966)	Nessus	CentOS Local Security Checks	Local	medium
352516	CentOS Linux 8.5 [TuxCare] Security Update: ImageMagick / ImageMagick-c++ / ImageMagick-c++-devel / etc Multiple Vulnerabilities (CENTOS8.5:CLSA-2026:1790328174)	Nessus	CentOS Local Security Checks	Local	medium
350982	SUSE SLES15: ImageMagick / ImageMagick-config-7-SUSE / etc (SUSE-SU-2026:4376-1)	Nessus	SuSE Local Security Checks	Local	medium
348613	Linux Distros Unpatched Vulnerability : CVE-2026-93588	Nessus	Misc.	Local	low

Detections

Analytics

CVE-2026-93588

low

Tenable Plugins

medium

medium

medium

medium

medium

critical

critical

medium

medium

medium

medium

low