ImageMagick CVE-2026-93590

Requires an application that feeds attacker-supplied images through ImageMagick's UHDR (Ultra HDR) encoder path - i.e. UHDR encoding must actually be exercised, which is a niche code path rather than the common JPEG/PNG pipeline. The severity is meaningfully realized only where operators depend on ImageMagick resource policies (policy.xml memory/area/disk limits) to constrain processing, since the bug is a bypass of exactly those policy checks during pixel-buffer allocation. Limiting factors: high attack complexity (AC:H) and a specific attack requirement (AT:P) mean the crafted image must reliably defeat the policy path; impact is confined to availability (memory-exhaustion DoS) with no confidentiality or integrity effect, and no code execution. Affected: ImageMagick before 7.1.2-31; unauthenticated network delivery is possible wherever image upload/conversion is exposed.

This is a genuinely low-priority issue despite a mid-range 6.3 vendor CVSS 4.0 score. The vector (CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L) makes the ceiling clear: no confidentiality or integrity impact, only LOW availability impact (VA:L), gated behind high attack complexity (AC:H) and a specific attack requirement (AT:P). The weakness is a resource-policy BYPASS - meaning its real-world impact is conditional on an operator having configured ImageMagick resource limits (policy.xml) that this UHDR-encoder path fails to honor; on a default install with no policy hardening the practical delta is smaller because unbounded allocation was already possible. No EPSS score, no CISA KEV listing, and no public POC are present in the provided data, so there is no evidence of active or automatable exploitation. Contrast the signals: the CVSS is network-reachable and unauthenticated (PR:N), which sounds serious, but AC:H + AT:P + availability-only impact pull real risk down to nuisance-DoS territory. Reported by VulnCheck with a vendor GitHub Security Advisory; patch is available. No conflicting data - the vector and description are consistent (network-delivered crafted image, memory-exhaustion DoS).

An attacker uploads or submits a specially crafted UHDR image to an application that uses ImageMagick to convert or encode it. Because the UHDR encoder skips resource-policy checks during pixel-buffer allocation, the crafted dimensions/metadata drive an oversized memory allocation that bypasses configured limits, exhausting host memory and degrading or crashing the processing service. No public exploit code is identified at time of analysis, and the high attack complexity means the crafted file must reliably defeat policy checks.