ImageMagick CVE-2026-93586

Requires the target to process an attacker-crafted/malformed image through ImageMagick's blob-conversion path (ImagesToBlob), on affected versions (before 7.1.2-31 in the 7.x line, before 6.9.13-56 in the 6.x line). The CVSS 4.0 vector is AV:L, so exploitation is bound to a local context - the malicious image must reach a local ImageMagick process/library invocation. AC:H plus AT:P indicate a non-trivial precondition and a hard-to-satisfy trigger, meaning the use-after-free does not fire reliably. Limiting factors: impact is confined to availability (a crash of the affected process, VA:L) with no confidentiality or integrity effect, no privilege escalation, and no evidence of code execution; there is no authentication needed (PR:N) but the local vector and high complexity substantially reduce real-world risk.

This is a genuinely low-priority issue despite being a memory-corruption/use-after-free class. The vendor CVSS 4.0 base score is 2.1 (LOW), and the vector tells the real story: AV:L (local - a crafted image must be fed to the local ImageMagick process/library), AC:H (high complexity), AT:P (a specific attack requirement/precondition must be met), PR:N/UI:N, and impact restricted to VA:L - availability only, no confidentiality (VC:N) and no integrity (VI:N). The description and advisory converge: exploitation 'may result in a limited availability impact (e.g., a crash of the affected process),' i.e. a DoS of the single processing worker, not code execution. No EPSS score is provided, there is no CISA KEV listing, and no public exploit/POC is referenced - only a vendor GitHub Security Advisory (GHSA-3rjr-534c-8v67) and a VulnCheck advisory. All signals agree (low CVSS, no KEV, no POC, availability-only, local vector, AC:H+AT:P), so there is no conflict to flag. UAF bugs can sometimes be escalated beyond a crash, but the vendor explicitly scopes impact to a crash and the 4.0 vector encodes VC:N/VI:N; treat any RCE speculation as unconfirmed. Net: patch during routine maintenance, not an emergency.

An attacker crafts a malformed image that, when converted to a blob via ImageMagick's ImagesToBlob path, triggers a stale pointer dereference (use-after-free) and crashes the process handling it. The realistic outcome is a denial of service against the specific worker/process performing the conversion - for example a batch image-processing job or a service that runs ImageMagick locally on supplied files. No public exploit code is identified, and the CVSS AC:H/AT:P metrics indicate the crash is not reliably triggerable.