CVE-2026-93590

medium

Description

ImageMagick before 7.1.2-31 contains a policy bypass vulnerability in the UHDR encoder that fails to perform policy checks during buffer allocation for image pixels. Attackers can bypass resource policies by processing specially crafted UHDR images, potentially causing denial of service through excessive memory allocation.

References

Advisories
More

https://www.vulncheck.com/advisories/imagemagick-before-7.1.2-31-policy-bypass-in-uhdr-encoder

https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-7hjx-392p-f8cm

https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-82909

Details

Source: Mitre, NVD

Published: 2026-09-18

Updated: 2026-10-16

Risk Information

CVSS v2

Base Score: 7.8

Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:C

Severity: High

CVSS v3

Base Score: 7.5

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Severity: High

CVSS v4

Base Score: 6.3

Vector: CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

Severity: Medium

EPSS

EPSS: 0.00387