ImageMagick before 7.1.2-31 contains a policy bypass vulnerability in the UHDR encoder that fails to perform policy checks during buffer allocation for image pixels. Attackers can bypass resource policies by processing specially crafted UHDR images, potentially causing denial of service through excessive memory allocation.

The remote host has a version of ImageMagick installed that is prior to 7.1.2-31. It is, therefore, affected by a vulnerability.

  - ImageMagick before 7.1.2-31 contains a policy bypass vulnerability in the UHDR encoder that fails to perform     policy checks during buffer allocation for image pixels. Attackers can bypass resource policies by processing     specially crafted UHDR images, potentially causing denial of service through excessive memory     allocation. (CVE-2026-93590)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES16 / SLES_SAP16 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:23948-1 advisory.

    - CVE-2026-93586: use-after-free in the `ImagesToBlob` method can lead to a process crash (bsc#1281912).
    - CVE-2026-93587: policy bypass in the PCD, CUBE and HALD coders can lead to extra memory allocation and a     denial of       service (bsc#1281909).
    - CVE-2026-93588: NULL pointer dereference in the PNM coder can lead to a denial of service (bsc#1281910).
    - CVE-2026-93589: division-by-zero flaw in the FLIF encoder can lead to a denial of service (bsc#1281911).
    - CVE-2026-93590: failure to perform policy checks during buffer allocation for image pixels in the UHDR     encoder can       lead to denial of service (bsc#1281913).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21973-1 advisory.

    - CVE-2026-93586: use-after-free in the `ImagesToBlob` method can lead to a process crash (bsc#1281912).
    - CVE-2026-93587: policy bypass in the PCD, CUBE and HALD coders can lead to extra memory allocation and a     denial of       service (bsc#1281909).
    - CVE-2026-93588: NULL pointer dereference in the PNM coder can lead to a denial of service (bsc#1281910).
    - CVE-2026-93589: division-by-zero flaw in the FLIF encoder can lead to a denial of service (bsc#1281911).
    - CVE-2026-93590: failure to perform policy checks during buffer allocation for image pixels in the UHDR     encoder can       lead to denial of service (bsc#1281913).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 26.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8859-1 advisory.

    It was discovered that ImageMagick did not correctly handle certain images. An attacker could possibly use     this issue to cause a denial of service or obtain sensitive information. This issue only affected Ubuntu     16.04 LTS, Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, and Ubuntu 24.04 LTS. (CVE-2026-56367)

    It was discovered that ImageMagick did not correctly handle certain images. An attacker could possibly use     this issue to cause a denial of service. (CVE-2026-93586)

    It was discovered that ImageMagick did not correctly handle certain images. A local attacker could     possibly use this issue to cause a denial of service. This issue only affected Ubuntu 20.04 LTS, Ubuntu     22.04 LTS, Ubuntu 24.04 LTS, and Ubuntu 26.04 LTS. (CVE-2026-93587, CVE-2026-93588)

    It was discovered that ImageMagick did not correctly handle certain images. An attacker could possibly use     this issue to cause a denial of service. This issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS,     Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, and Ubuntu 26.04 LTS. (CVE-2026-93589)

    It was discovered that ImageMagick did not correctly handle certain images. An attacker could possibly use     this issue to cause a denial of service. This issue only affected Ubuntu 26.04 LTS. (CVE-2026-93590)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - ImageMagick before 7.1.2-31 contains a policy bypass vulnerability in the UHDR encoder that fails to     perform policy checks during buffer allocation for image pixels. Attackers can bypass resource policies by     processing specially crafted UHDR images, potentially causing denial of service through excessive memory     allocation. (CVE-2026-93590)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
362652	ImageMagick < 7.1.2-31 UHDR Encoder Policy Bypass	Nessus	Misc.	Local	medium
362583	SUSE SLES16: ImageMagick / ImageMagick-config-7-SUSE / etc (SUSE-SU-2026:23948-1)	Nessus	SuSE Local Security Checks	Local	medium
362523	openSUSE 16: ImageMagick / ImageMagick-config-7-SUSE / etc (openSUSE-SU-2026:21973-1)	Nessus	SuSE Local Security Checks	Local	medium
362462	Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 26.04 LTS : ImageMagick vulnerabilities (USN-8859-1)	Nessus	Ubuntu Local Security Checks	Local	medium
348628	Linux Distros Unpatched Vulnerability : CVE-2026-93590	Nessus	Misc.	Local	medium

Detections

Analytics

CVE-2026-93590

medium

Tenable Plugins

medium

medium

medium

medium

medium