ImageMagick CVE-2026-93589

Exploitation requires that the target application uses ImageMagick to ENCODE an image into FLIF format, and that the attacker can influence the image's ticks-per-second field to an invalid (zero-producing) value; the FLIF encoder path must be reachable with attacker-controlled data. Limiting factors: the CVSS AC:H and AT:P indicate a specific malformed-value condition rather than trivial triggering, and FLIF is a relatively uncommon output format, so most deployments that never encode to FLIF are not exposed. Impact is confined to a crash of the encoder (availability only) - no code execution, data disclosure, or data modification.

This is a genuine but low-severity issue: a CWE-369 division-by-zero in ImageMagick's FLIF encoder that crashes the encoder process, producing only a denial of service. The vendor CVSS 4.0 vector (AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L) confirms the impact is limited to availability at Low, with no confidentiality or integrity effect and no scope change to subsequent systems - the elevated 6.3 numeric score is an artifact of CVSS 4.0 scoring rather than a reflection of real-world urgency. The reported vector is unauthenticated network (PR:N) but carries AC:H and AT:P (a specific attack requirement), meaning the crash only triggers when the encoder is driven to write FLIF output with a malformed ticks-per-second value - not against arbitrary inputs. No EPSS score, no CISA KEV listing, and no public POC are present in the provided data, so there is no evidence of active exploitation; the finding was reported by VulnCheck as a research advisory. Net assessment: this is a high-CVSS-number-but-low-real-risk issue - a memory-safe crash bug worth patching in the normal cycle, not an emergency. Note the CVSS vector says network/unauthenticated, but exploitation realistically depends on an application actually invoking FLIF encoding on attacker-influenced data, which is an uncommon code path.

An attacker supplies an image (or image parameters) to a service that uses ImageMagick to encode output in FLIF format, setting an invalid ticks-per-second value so the encoder performs a divide-by-zero and crashes. This aborts the conversion and denies service to that request or worker. No public exploit code is identified at time of analysis, and exploitation depends on the target actually exposing a FLIF encoding path.