ImageMagick before 7.1.2-31 and 6.9.13-56 contains a division-by-zero flaw in the FLIF encoder. An incorrect value for ticks per second in the image being encoded causes a divide-by-zero and crashes the encoder, resulting in a denial of service. The issue is fixed in 7.1.2-31 and 6.9.13-56.

The remote host has a version of ImageMagick installed that is prior to 6.9.13-56, or 7.x prior to 7.1.2-31. It is, therefore, affected by multiple vulnerabilities:

  - ImageMagick before 7.1.2-31 and before 6.9.13-56 contains a NULL pointer dereference in the PNM coder. When     the coder reaches a memory (resource) limit at a specific point during processing, the failed allocation is     not handled and a NULL pointer is dereferenced, which can lead to a denial of service (application crash)     when processing a specially crafted or sufficiently large PNM image. (CVE-2026-93588)

  - ImageMagick before 7.1.2-31 and before 6.9.13-56 contains a use-after-free vulnerability in the ImagesToBlob     method, caused by a pointer that is not updated correctly. Exploitation may result in a limited availability     impact (e.g., a crash of the affected process). (CVE-2026-93586)

  - ImageMagick before 7.1.2-31 and 6.9.13-56 contains a division-by-zero flaw in the FLIF encoder. An incorrect     value for ticks per second in the image being encoded causes a divide-by-zero and crashes the encoder,     resulting in a denial of service. (CVE-2026-93589)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES16 / SLES_SAP16 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:23948-1 advisory.

    - CVE-2026-93586: use-after-free in the `ImagesToBlob` method can lead to a process crash (bsc#1281912).
    - CVE-2026-93587: policy bypass in the PCD, CUBE and HALD coders can lead to extra memory allocation and a     denial of       service (bsc#1281909).
    - CVE-2026-93588: NULL pointer dereference in the PNM coder can lead to a denial of service (bsc#1281910).
    - CVE-2026-93589: division-by-zero flaw in the FLIF encoder can lead to a denial of service (bsc#1281911).
    - CVE-2026-93590: failure to perform policy checks during buffer allocation for image pixels in the UHDR     encoder can       lead to denial of service (bsc#1281913).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21973-1 advisory.

    - CVE-2026-93586: use-after-free in the `ImagesToBlob` method can lead to a process crash (bsc#1281912).
    - CVE-2026-93587: policy bypass in the PCD, CUBE and HALD coders can lead to extra memory allocation and a     denial of       service (bsc#1281909).
    - CVE-2026-93588: NULL pointer dereference in the PNM coder can lead to a denial of service (bsc#1281910).
    - CVE-2026-93589: division-by-zero flaw in the FLIF encoder can lead to a denial of service (bsc#1281911).
    - CVE-2026-93590: failure to perform policy checks during buffer allocation for image pixels in the UHDR     encoder can       lead to denial of service (bsc#1281913).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 26.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8859-1 advisory.

    It was discovered that ImageMagick did not correctly handle certain images. An attacker could possibly use     this issue to cause a denial of service or obtain sensitive information. This issue only affected Ubuntu     16.04 LTS, Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, and Ubuntu 24.04 LTS. (CVE-2026-56367)

    It was discovered that ImageMagick did not correctly handle certain images. An attacker could possibly use     this issue to cause a denial of service. (CVE-2026-93586)

    It was discovered that ImageMagick did not correctly handle certain images. A local attacker could     possibly use this issue to cause a denial of service. This issue only affected Ubuntu 20.04 LTS, Ubuntu     22.04 LTS, Ubuntu 24.04 LTS, and Ubuntu 26.04 LTS. (CVE-2026-93587, CVE-2026-93588)

    It was discovered that ImageMagick did not correctly handle certain images. An attacker could possibly use     this issue to cause a denial of service. This issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS,     Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, and Ubuntu 26.04 LTS. (CVE-2026-93589)

    It was discovered that ImageMagick did not correctly handle certain images. An attacker could possibly use     this issue to cause a denial of service. This issue only affected Ubuntu 26.04 LTS. (CVE-2026-93590)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The CentOS Linux 7 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS7:CLSA-2026:1790241027 advisory.

  - ImageMagick before 7.1.2-31 and 6.9.13-56 contains a division-by-zero flaw in the FLIF encoder. An     incorrect value for ticks per second in the image being encoded causes a divide-by-zero and crashes the     encoder, resulting in a denial of service. The issue is fixed in 7.1.2-31 and 6.9.13-56. (CVE-2026-93589)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4376-1 advisory.

    - CVE-2026-62343: heap buffer over-write in morphology operation when an invalid kernel is provided     (bsc#1272575).
    - CVE-2026-62363: heap buffer over-write in fx operation (bsc#1272582).
    - CVE-2026-62946: integer overflow in JNX decoder causes heap buffer over-write when processing extremly     large files on       32-bit builds (bsc#1272580).
    - CVE-2026-64685: heap buffer over-read in BGR decoder due to missing end-of-file check (bsc#1272953).
    - CVE-2026-66011: memory Leak when providing invalid options to the cli (bsc#1272577).
    - CVE-2026-86420: denial of Service due to memory budget exhaustion (bsc#1279696).
    - CVE-2026-86421: denial of Service via memory leak in MSL decoder (bsc#1279711).
    - CVE-2026-86423: denial of service via heap-use-after-free in PerlMagick's GetList method (bsc#1279794).
    - CVE-2026-86425: denial of Service due to heap-use-after-free vulnerability (bsc#1279797).
    - CVE-2026-93586: use-after-free in the `ImagesToBlob` method can lead to a process crash (bsc#1281912).
    - CVE-2026-93587: policy bypass in the PCD, CUBE and HALD coders can lead to extra memory allocation and a     denial of       service (bsc#1281909).
    - CVE-2026-93588: NULL pointer dereference in the PNM coder can lead to a denial of service (bsc#1281910).
    - CVE-2026-93589: division-by-zero flaw in the FLIF encoder can lead to a denial of service (bsc#1281911).
    - GHSA-hc76-7mpc-qjqh: code injection in HTML encoder due to incomplete fix of CVE-2026-25797     (bsc#1272579).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - ImageMagick before 7.1.2-31 and 6.9.13-56 contains a division-by-zero flaw in the FLIF encoder. An     incorrect value for ticks per second in the image being encoded causes a divide-by-zero and crashes the     encoder, resulting in a denial of service. The issue is fixed in 7.1.2-31 and 6.9.13-56. (CVE-2026-93589)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
362654	ImageMagick < 6.9.13-56 / 7.x < 7.1.2-31 Multiple Vulnerabilities	Nessus	Misc.	Local	medium
362583	SUSE SLES16: ImageMagick / ImageMagick-config-7-SUSE / etc (SUSE-SU-2026:23948-1)	Nessus	SuSE Local Security Checks	Local	medium
362523	openSUSE 16: ImageMagick / ImageMagick-config-7-SUSE / etc (openSUSE-SU-2026:21973-1)	Nessus	SuSE Local Security Checks	Local	medium
362462	Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 26.04 LTS : ImageMagick vulnerabilities (USN-8859-1)	Nessus	Ubuntu Local Security Checks	Local	medium
353314	CentOS Linux 7 [TuxCare] Security Update: ImageMagick / ImageMagick-c++ / ImageMagick-c++-devel / etc (CENTOS7:CLSA-2026:1790241027)	Nessus	CentOS Local Security Checks	Local	medium
350982	SUSE SLES15: ImageMagick / ImageMagick-config-7-SUSE / etc (SUSE-SU-2026:4376-1)	Nessus	SuSE Local Security Checks	Local	medium
348646	Linux Distros Unpatched Vulnerability : CVE-2026-93589	Nessus	Misc.	Local	medium

Detections

Analytics

CVE-2026-93589

medium

Tenable Plugins

medium

medium

medium

medium

medium

medium

medium