ImageMagick CVE-2026-93587

Requires a local user with the ability to pass arbitrary command-line options to ImageMagick, and a deployment where a memory resource limit is configured via policy (the flaw is a bypass of that intended limit). The specific triggering command-line option must be supplied to invoke the PCD (or, per the upstream advisory, CUBE or HALD) coder, whose decoder fails to check the configured resource limit. Limiting factors: exploitation is LOCAL only (AV:L) - no remote/network path; the attacker must already be able to control ImageMagick invocation options (PR:L); and impact is confined to limited availability degradation (no code execution, no data exposure, no integrity change). Environments that call ImageMagick with fixed, non-user-controlled arguments are not exposed.

This is a low-priority issue despite the CWE-400 resource-exhaustion classification. The vendor CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L) scores 4.8 (Medium) and is internally consistent with the description: the attack vector is LOCAL, requires low privileges (a user already able to invoke ImageMagick with command-line options), needs no user interaction, and produces only a limited availability impact (VA:L) with zero confidentiality or integrity impact. Exploitation status is 'no public exploit identified at time of analysis' - there is no EPSS score, no CISA KEV listing, and no explicit proof-of-concept in the provided references (only a GitHub advisory and a VulnCheck advisory). No signals conflict here: every source points to a bounded, local, availability-only weakness. The real-world risk is low - this is a policy-limit bypass that lets an already-authorized local user allocate more memory than the configured policy intends, not a remote or high-impact flaw. The CVSS network-vs-local framing is unambiguous (AV:L), so there is no vector/description mismatch to reconcile.

A local user who is permitted to run ImageMagick (for example on a shared host or via a constrained conversion service) supplies the specific command-line option that triggers the PCD, CUBE, or HALD coder path, which skips the configured memory resource-limit check. This lets the user allocate memory beyond the intended policy ceiling, degrading availability on the host. No public exploit code is identified, and exploitation requires the ability to pass arbitrary command-line options directly.