Allocation of Resources Without Limits or Throttling in ImageMagick - CVE-2026-93590

Vulnerability identifier: #VU147198

CSH Severity: Low

CVSS v4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

CVE-ID: CVE-2026-93590

CWE-ID: CWE-770

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to allocation of resources without limits or throttling in the UHDR encoder when allocating a buffer that contains all the pixels of an image. A remote attacker can cause the encoder to allocate a buffer containing all the pixels of an image to cause a denial of service.

ImageMagick
Ubuntu
SUSE Linux Enterprise Server
SUSE Linux Enterprise Server for SAP Applications
openEuler
ImageMagick-config-7-upstream-limited
libMagickCore-7_Q16HDRI10
ImageMagick
perl-PerlMagick
ImageMagick-extra
ImageMagick-debugsource
ImageMagick-extra-debuginfo
libMagick++-7_Q16HDRI5
libMagick++-7_Q16HDRI5-debuginfo
libMagick++-devel
libMagickWand-7_Q16HDRI10
ImageMagick-devel
libMagickWand-7_Q16HDRI10-debuginfo
perl-PerlMagick-debuginfo
libMagickCore-7_Q16HDRI10-debuginfo
ImageMagick-debuginfo
ImageMagick-doc
ImageMagick-config-7-SUSE
ImageMagick-config-7-upstream-websafe
ImageMagick-config-7-upstream-secure
ImageMagick-config-7-upstream-open
ImageMagick-c++
ImageMagick-help
ImageMagick-perl
ImageMagick-c++-devel
imagemagick (Ubuntu package)

Install security update from vendor's website.

ImageMagick - update to 7.1.2-31
ImageMagick-config-7-upstream-limited - update to 7.1.2.0-160000.16.1
libMagickCore-7_Q16HDRI10 - update to 7.1.2.0-160000.16.1
ImageMagick - update to 7.1.2.0-160000.16.1
perl-PerlMagick - update to 7.1.2.0-160000.16.1
ImageMagick-extra - update to 7.1.2.0-160000.16.1
ImageMagick-debugsource - update to 7.1.2.0-160000.16.1
ImageMagick-extra-debuginfo - update to 7.1.2.0-160000.16.1
libMagick++-7_Q16HDRI5 - update to 7.1.2.0-160000.16.1
libMagick++-7_Q16HDRI5-debuginfo - update to 7.1.2.0-160000.16.1
libMagick++-devel - update to 7.1.2.0-160000.16.1
libMagickWand-7_Q16HDRI10 - update to 7.1.2.0-160000.16.1
ImageMagick-devel - update to 7.1.2.0-160000.16.1
libMagickWand-7_Q16HDRI10-debuginfo - update to 7.1.2.0-160000.16.1
perl-PerlMagick-debuginfo - update to 7.1.2.0-160000.16.1
libMagickCore-7_Q16HDRI10-debuginfo - update to 7.1.2.0-160000.16.1
ImageMagick-debuginfo - update to 7.1.2.0-160000.16.1
ImageMagick-doc - update to 7.1.2.0-160000.16.1
ImageMagick-config-7-SUSE - update to 7.1.2.0-160000.16.1
ImageMagick-config-7-upstream-websafe - update to 7.1.2.0-160000.16.1
ImageMagick-config-7-upstream-secure - update to 7.1.2.0-160000.16.1
ImageMagick-config-7-upstream-open - update to 7.1.2.0-160000.16.1
ImageMagick-c++ - update to 7.1.2.32-1
ImageMagick-help - update to 7.1.2.32-1
ImageMagick-perl - update to 7.1.2.32-1
ImageMagick-devel - update to 7.1.2.32-1
ImageMagick-debugsource - update to 7.1.2.32-1
ImageMagick-debuginfo - update to 7.1.2.32-1
ImageMagick - update to 7.1.2.32-1
ImageMagick-c++-devel - update to 7.1.2.32-1
imagemagick (Ubuntu package) - addressed in versions 8:6.7.7.10-6ubuntu3.13+esm27, 8:6.8.9.9-7ubuntu5.16+esm26, 8:6.9.7.4+dfsg-16ubuntu6.15+esm18, 8:6.9.10.23+dfsg-2.1ubuntu11.11+esm16, 8:6.9.11.60+dfsg-1.3ubuntu0.22.04.5+esm16, 8:6.9.12.98+dfsg1-5.2ubuntu0.1~esm15, 8:7.1.2.18+dfsg1-1ubuntu0.1~esm4

• https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-7hjx-392p-f8cm

• Multiple vulnerabilities in ImageMagick
• openEuler 22.03 LTS SP4 update for ImageMagick
• openEuler 24.03 LTS SP4 update for ImageMagick
• openEuler 24.03 LTS SP3 update for ImageMagick
• openEuler 24.03 LTS SP1 update for ImageMagick
• SUSE update for ImageMagick
• Ubuntu update for imagemagick