CVE-2026-93590: ImageMagick UHDR Policy Bypass DoS Vulnerability

CVE-2026-93590 Overview

CVE-2026-93590 is a policy bypass vulnerability in ImageMagick versions prior to 7.1.2-31. The flaw resides in the Ultra HDR (UHDR) encoder, which fails to enforce configured resource policies during buffer allocation for image pixels. Attackers can submit specially crafted UHDR images that trigger excessive memory allocation, bypassing limits defined in policy.xml. The result is a denial of service (DoS) condition on systems processing untrusted images. The vulnerability is tracked under CWE-400 (Uncontrolled Resource Consumption) and is documented in GitHub Security Advisory GHSA-7hjx-392p-f8cm.

Critical Impact
Remote attackers can bypass ImageMagick resource policies to exhaust system memory through crafted UHDR images, causing denial of service on image-processing servers.

Affected Products

ImageMagick versions prior to 7.1.2-31
Web applications and services that process user-supplied UHDR images through ImageMagick
Container images and Linux distributions bundling vulnerable ImageMagick builds

Discovery Timeline

2026-09-18 - CVE-2026-93590 published to the National Vulnerability Database (NVD)
2026-09-22 - Last updated in NVD database

Technical Details for CVE-2026-93590

Vulnerability Analysis

ImageMagick enforces resource limits through a policy.xml configuration file that governs memory, disk, width, height, and area constraints for image processing. These policies exist to prevent resource-exhaustion attacks against services that accept untrusted image input. The UHDR encoder in versions prior to 7.1.2-31 allocates pixel buffers without consulting these policy checks. An attacker who submits a crafted Ultra HDR image can force ImageMagick to allocate memory far beyond the administrator-defined limits. Sustained or parallel requests can exhaust process or host memory, disrupting the service and potentially collocated workloads.

Root Cause

The root cause is a missing enforcement path in the UHDR encoder's buffer allocation routine. The encoder omits calls to the ImageMagick resource-limit validator before requesting pixel storage. This categorization aligns with CWE-400, Uncontrolled Resource Consumption, where a program permits allocation of resources without bounds. Because the policy engine is the primary control preventing memory-based DoS in ImageMagick, bypassing it removes the defensive layer administrators rely on.

Attack Vector

Exploitation requires an attacker to deliver a crafted UHDR image to a system that processes it with ImageMagick. Typical attack surfaces include image upload endpoints, thumbnail generators, media conversion pipelines, and content moderation workflows. No authentication is required when the target application accepts anonymous uploads. The vulnerability does not permit code execution or data disclosure; impact is limited to availability. See the Vulncheck advisory for additional technical context.

Detection Methods for CVE-2026-93590

Indicators of Compromise

Sudden spikes in resident memory usage by ImageMagick worker processes (magick, convert, identify) coinciding with UHDR file uploads
Out-of-memory (OOM) killer events terminating ImageMagick or its parent web application processes
HTTP upload logs referencing .jpg or .uhdr files with the image/uhdr MIME type followed by service degradation
Repeated failed image conversion jobs in application logs shortly after external file submissions

Detection Strategies

Inventory installed ImageMagick versions across servers and containers, flagging any build earlier than 7.1.2-31
Correlate image-processing service crashes with inbound file uploads to identify possible exploitation attempts
Instrument ImageMagick invocations with cgroup memory accounting to detect allocations exceeding policy thresholds
Deploy web application firewall (WAF) rules to log UHDR content-type submissions to endpoints that do not normally receive them

Monitoring Recommendations

Alert on process RSS growth beyond expected baselines for image conversion workers
Monitor kernel logs for oom-killer invocations targeting ImageMagick processes
Track HTTP 5xx error rates on image upload and transformation endpoints
Log and retain metadata for all uploaded image files, including format, size, and source IP, to support post-incident analysis

How to Mitigate CVE-2026-93590

Immediate Actions Required

Upgrade ImageMagick to version 7.1.2-31 or later on all systems that process untrusted image input
Rebuild and redeploy container images that bundle ImageMagick to pull in the patched release
If patching is not immediately possible, disable the UHDR coder in policy.xml to remove the vulnerable code path
Constrain ImageMagick workers with operating system resource limits such as cgroups, ulimit, or systemd MemoryMax directives

Patch Information

The upstream fix is included in ImageMagick 7.1.2-31. Refer to the GitHub Security Advisory GHSA-7hjx-392p-f8cm for the authoritative patch reference and update instructions. Linux distributions typically backport the fix to their supported ImageMagick packages; verify vendor changelogs to confirm coverage.

Workarounds

Disable the UHDR coder in the ImageMagick policy.xml file until the patched version can be deployed
Reject UHDR file uploads at the application or WAF layer for services that do not require this format
Run ImageMagick inside a sandbox or container with strict memory and CPU limits enforced by the host
Rate-limit image upload endpoints to reduce the impact of repeated exploitation attempts

bash

# Example policy.xml entry to disable the UHDR coder
# Add inside the <policymap> element
<policy domain="coder" rights="none" pattern="UHDR" />

# Example systemd service hardening for an ImageMagick worker
[Service]
MemoryMax=512M
TasksMax=64
LimitAS=536870912