CVE-2026-93590 is a low severity (CVSS 3.7) policy bypass in the UHDR encoder of ImageMagick before 7.1.2-31. The encoder does not check resource policies when it allocates a buffer for all image pixels, so crafted images can cause excessive memory use. Upgrade to 7.1.2-31.
What's affected
The advisory lists ImageMagick before 7.1.2-31 as affected and names 7.1.2-31 as the patched version. Unlike the sibling FLIF issue fixed in the same release, this advisory does not list a 6.9.x fixed version, so check the project's release notes if you run the 6.9 line.
The weakness is CWE-400, uncontrolled resource consumption. The description in the advisory is short: the UHDR encoder does not perform a policy check when allocating the buffer that holds all the pixels of an image. ImageMagick's resource policy is how operators cap memory, disk and image dimensions, so skipping it removes a safety net that many deployments rely on.
How to check if you're exposed
Read the version and the active policy limits.
magick -version
magick -list resource
magick -list policy
The resource listing shows the memory, map and area limits your build enforces. If your service converts untrusted images, those limits are your main defense against heavy inputs, and this bug is a case where one code path did not honor them.
Also check whether your build includes UHDR support. A build without it does not run the vulnerable encoder.
What to do now
- Upgrade ImageMagick to 7.1.2-31 or later, or apply your distribution's patched package.
- Set conservative resource limits in your policy file for memory, map, area and time, and test them against your real workloads.
- Run image conversion in a container or process with its own memory ceiling, so one request cannot use the host's memory.
- If you run the 6.9 line, check the project advisory and release notes for whether a fix applies to you.
- Paste your lockfile or manifest into the free in-browser dependency scan to see whether the affected package is in your tree, then use reachability analysis to separate code paths you call from ones you never touch.
Why it matters
Resource policies only work if every encoder and decoder follows them. When one path allocates memory without asking, an attacker can pick the input that triggers it. The effect here is denial of service, which is why the score is low. CWE-400 problems matter most when conversion runs inside a shared web service, where one bad upload can slow everyone.
The record does not mark this as exploited, and it is not in CISA's catalog. Apply it with the FLIF fix from the same release.
Quick check
Does a memory limit in my policy file protect me?
Not fully for this bug. The point of the advisory is that this encoder skipped the policy check when allocating pixels. Upgrade, and keep an outer memory limit on the process as well.
Is this the same release as the FLIF fix?
Yes. 7.1.2-31 contains the fix for both issues.
Sources
Last reviewed: 18 October 2026.
