CVE-2026-93587
Fixed in a distro release EPSS <1%CVSS 3.3
ImageMagick before 7.1.2-31 and before 6.9.13-56 contains a policy bypass in the PCD (and, per the upstream advisory, CUBE and HALD) coder: when a specific command line option is supplied, the decoder does not check a configured resource limit, which can result in extra memory allocation. A local user able to pass command line options to ImageMagick can therefore exceed the intended memory policy limit, causing a limited availability impact. The issue is fixed in 7.1.2-31 and 6.9.13-56.
Products: imagemagick
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 12 | imagemagick | 8:6.9.11.60+dfsg-1.6+deb12u14 |
| Debian 13 | imagemagick | no fix |
| Debian 14 | imagemagick | 8:7.1.2.31+dfsg1-1 |
| SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS | ImageMagick | 7.1.0.9-150400.6.122.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS | ImageMagick | 7.1.0.9-150400.6.122.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS | ImageMagick | 7.1.0.9-150400.6.122.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS | ImageMagick | 7.1.0.9-150400.6.122.1 |
| SUSE Linux Enterprise Module for Desktop Applications 15 SP7 | ImageMagick | 7.1.1.43-150700.3.84.1 |
| SUSE Linux Enterprise Module for Desktop Applications 15 SP7 | ImageMagick | 7.1.0.9-150400.6.122.1 |
| SUSE Linux Enterprise Module for Development Tools 15 SP7 | ImageMagick | 7.1.1.43-150700.3.84.1 |
| SUSE Linux Enterprise Server 15 SP4-LTSS | ImageMagick | 7.1.0.9-150400.6.122.1 |
| SUSE Linux Enterprise Server 15 SP5-LTSS | ImageMagick | 7.1.0.9-150400.6.122.1 |
| SUSE Linux Enterprise Server 15 SP6-LTSS | ImageMagick | 7.1.1.21-150600.3.87.1 |
| SUSE Linux Enterprise Server 15 SP6-LTSS | ImageMagick | 7.1.0.9-150400.6.122.1 |
| SUSE Linux Enterprise Server 16.0 | ImageMagick | 7.1.2.0-160000.16.1 |
| SUSE Linux Enterprise Server for SAP Applications 15 SP4 | ImageMagick | 7.1.0.9-150400.6.122.1 |
| SUSE Linux Enterprise Server for SAP Applications 15 SP5 | ImageMagick | 7.1.0.9-150400.6.122.1 |
| SUSE Linux Enterprise Server for SAP Applications 15 SP6 | ImageMagick | 7.1.1.21-150600.3.87.1 |
| SUSE Linux Enterprise Server for SAP Applications 15 SP6 | ImageMagick | 7.1.0.9-150400.6.122.1 |
| SUSE Linux Enterprise Server for SAP applications 16.0 | ImageMagick | 7.1.2.0-160000.16.1 |
| Ubuntu Pro 14.04 LTS | imagemagick | 8:6.7.7.10-6ubuntu3.13+esm27 |
| Ubuntu Pro 16.04 LTS | imagemagick | 8:6.8.9.9-7ubuntu5.16+esm26 |
| Ubuntu Pro 18.04 LTS | imagemagick | 8:6.9.7.4+dfsg-16ubuntu6.15+esm18 |
| Ubuntu Pro 20.04 LTS | imagemagick | 8:6.9.10.23+dfsg-2.1ubuntu11.11+esm16 |
| Ubuntu Pro 22.04 LTS | imagemagick | 8:6.9.11.60+dfsg-1.3ubuntu0.22.04.5+esm16 |
| Ubuntu Pro 24.04 LTS | imagemagick | 8:6.9.12.98+dfsg1-5.2ubuntu0.1~esm15 |
| Ubuntu Pro 26.04 LTS | imagemagick | 8:7.1.2.18+dfsg1-1ubuntu0.1~esm4 |
| openSUSE Leap 16.0 | ImageMagick | 7.1.2.0-160000.16.1 |
| openSUSE Tumbleweed | ImageMagick | 7.1.2.31-2.1 |