CVE-2026-93587 Overview
CVE-2026-93587 is a resource-limit policy bypass in ImageMagick versions before 7.1.2-31 and 6.9.13-56. The flaw resides in the Photo CD (PCD) coder and, per the upstream advisory, also affects the CUBE and HALD coders. When a user supplies a specific command line option, the decoder skips a configured resource limit check and performs additional memory allocation. A local user able to pass command line options to ImageMagick can therefore exceed the memory policy limit set by the administrator. The weakness is classified as CWE-400 (Uncontrolled Resource Consumption), producing a limited availability impact on the host.
Critical Impact
Local users can bypass ImageMagick memory policy limits through the PCD, CUBE, and HALD coders, driving unbounded allocation and localized denial of service.
Affected Products
- ImageMagick versions prior to 7.1.2-31
- ImageMagick 6.x versions prior to 6.9.13-56
- Applications and services invoking the affected PCD, CUBE, or HALD coders
Discovery Timeline
- 2026-09-18 - CVE-2026-93587 published to NVD
- 2026-09-22 - Last updated in NVD database
Technical Details for CVE-2026-93587
Vulnerability Analysis
ImageMagick enforces resource ceilings through its policy.xml configuration, which administrators use to cap memory, disk, and map allocations for image decoding. This vulnerability breaks that contract inside the PCD coder path. When a specific command line option is supplied to the decoder, the coder allocates additional memory without consulting the configured resource limit. The upstream advisory notes the same defect pattern exists in the CUBE and HALD coders. A local user who can invoke magick or convert with attacker-chosen options can therefore push allocations past the intended ceiling. The result is uncontrolled resource consumption on the host, degrading availability of the ImageMagick process and any co-resident workloads sharing the same memory budget.
Root Cause
The root cause is a missing resource-limit check in the decoder logic for the PCD, CUBE, and HALD coders. When the specific command line option is present, the code path bypasses the guard that normally reconciles allocation requests against the policy defined in policy.xml. This is a classic CWE-400 pattern: a control exists but is not applied on every reachable branch.
Attack Vector
Exploitation requires local access and the ability to pass command line arguments to ImageMagick. The attacker does not need elevated privileges beyond an authenticated local user context. No user interaction from another party is required. The impact is limited to availability; confidentiality and integrity are not affected. Verified proof-of-concept code is not published in the referenced advisories, so the vulnerability is described in prose here. Technical details are available in the GitHub Security Advisory GHSA-89wq-f8f6-2j2v and the VulnCheck ImageMagick Policy Bypass Advisory.
Detection Methods for CVE-2026-93587
Indicators of Compromise
- Unexpected memory growth in magick, convert, or other ImageMagick processes exceeding the configured policy.xml memory ceiling.
- Local invocations of ImageMagick referencing PCD, CUBE, or HALD coder inputs from untrusted users.
- Out-of-memory (OOM) killer events terminating ImageMagick or sibling processes on shared hosts.
Detection Strategies
- Audit command line arguments passed to ImageMagick binaries, focusing on inputs that route through the PCD, CUBE, or HALD coders.
- Correlate ImageMagick process memory usage against the limits declared in policy.xml to surface bypass attempts.
- Alert on repeated ImageMagick invocations from non-administrative local accounts on multi-tenant systems.
Monitoring Recommendations
- Enable process-level memory telemetry and OOM event logging on hosts running ImageMagick.
- Track installed ImageMagick versions across the estate and flag any host below 7.1.2-31 or 6.9.13-56.
- Monitor for unusual spikes in image conversion workloads that could indicate abuse of the affected coders.
How to Mitigate CVE-2026-93587
Immediate Actions Required
- Upgrade ImageMagick to 7.1.2-31 or later on the 7.x branch, or 6.9.13-56 or later on the 6.x branch.
- Inventory all systems, containers, and application dependencies that ship ImageMagick libraries or binaries.
- Restrict local shell access on hosts where ImageMagick processes user-controlled arguments.
Patch Information
The issue is fixed in ImageMagick 7.1.2-31 and 6.9.13-56. Refer to the GitHub Security Advisory GHSA-89wq-f8f6-2j2v for the upstream fix commit and the VulnCheck ImageMagick Policy Bypass Advisory for additional context.
Workarounds
- Disable the PCD, CUBE, and HALD coders in policy.xml where they are not required by the application.
- Enforce cgroup or systemd MemoryMax limits on ImageMagick processes to cap the blast radius of a bypass.
- Route untrusted image processing to isolated, resource-constrained sandboxes rather than shared hosts.
# Example policy.xml entries to disable the affected coders
# Place inside the <policymap> element of /etc/ImageMagick-7/policy.xml
<policy domain="coder" rights="none" pattern="PCD" />
<policy domain="coder" rights="none" pattern="CUBE" />
<policy domain="coder" rights="none" pattern="HALD" />
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.