CVE-2026-93589 is a low severity (CVSS 3.7) division by zero in the FLIF encoder of ImageMagick. An incorrect ticks per second value in the image being encoded crashes the encoder and denies service. It is fixed in ImageMagick 7.1.2-31 and 6.9.13-56.
What's affected
The ImageMagick advisory lists ImageMagick before 7.1.2-31 on the 7.x line and before 6.9.13-56 on the 6.x line as affected. The patched versions are 7.1.2-31 and 6.9.13-56. The weakness is CWE-369, divide by zero.
The advisory rates the issue Low with a CVSS score of 3.7. That matches the record. The vector shows network reach with high attack complexity, no privileges or user interaction, and a low availability impact only. There is no confidentiality or integrity impact.
Only the FLIF encoder is involved. If your ImageMagick build has no FLIF support, or you never encode to that format, the code path is not used.
How to check if you're exposed
Check the version first.
magick -version
convert -version
Then see whether your build knows the format at all.
magick -list format | grep -i flif
If FLIF is not listed, the encoder is not in your build. Remember that Linux distributions often backport fixes without changing the upstream version number, so a lower version string is not proof of exposure. Check your vendor's security tracker for this CVE.
What to do now
- Upgrade ImageMagick to 7.1.2-31 or 6.9.13-56 or later, or install your distribution's patched package.
- If you cannot upgrade soon, avoid running the encoder on untrusted input and consider limiting the formats the service accepts.
- Make sure services that call ImageMagick in a worker process restart cleanly after a crash, so a single bad file does not stall a queue.
- Rebuild container images that bundle ImageMagick so the fixed version is what ships.
- Paste your lockfile or manifest into the free in-browser dependency scan to see whether the affected package is in your tree, then use reachability analysis to separate code paths you call from ones you never touch.
Why it matters
A division by zero is a small bug with a narrow effect. The process stops, and nothing else is exposed. That is why the score is low. CWE-369 issues become more important in places where the crash is expensive, such as an image pipeline that handles user uploads and retries failed jobs without limit.
The record does not list the CVE as exploited in the wild, and CISA does not list it. Treat it as routine maintenance: fold it into the next ImageMagick update, and make sure you are not running a version old enough to carry many other fixes at once.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Can this expose my data?
No. The advisory and the vector describe a crash only, with no confidentiality or integrity impact.
Which versions are fixed?
7.1.2-31 on the 7.x line and 6.9.13-56 on the 6.x line.
Sources
Last reviewed: 18 October 2026.
