Vulnerability · Published Sep 18, 2026 · Assigned by VulnCheck
CVE-2026-93588ImageMagick before 7.1.2-31 Null Pointer Dereference via PNM
Low 3.1
In plain English
A low-severity null pointer dereference in ImageMagick from ImageMagick. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 19% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
ImageMagick before 7.1.2-31 and before 6.9.13-56 contains a NULL pointer dereference in the PNM coder. When the coder reaches a memory (resource) limit at a specific point during processing, the failed allocation is not handled and a NULL pointer is dereferenced, which can lead to a denial of service (application crash) when processing a specially crafted or sufficiently large PNM image.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | imagemagick | 8:6.9.11.60+dfsg-1.6+deb12u14 | DEBIAN-CVE-2026-93588 |
| Debian:13 | imagemagick | 8:7.1.1.43+dfsg1-1+deb13u13 | DEBIAN-CVE-2026-93588 |
| Debian:14 | imagemagick | 8:7.1.2.31+dfsg1-1 | DEBIAN-CVE-2026-93588 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| ImageMagick | ImageMagick | 7.0.0 – before 7.1.2-31 |
| ImageMagick | ImageMagick | 0 – before 6.9.13-56 |
Weakness: CWE-476 · Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L
References
- GitHub Security Advisory (GHSA-92rw-c5mw-27v4) vendor-advisory
- VulnCheck Advisory: ImageMagick before 7.1.2-31 Null Pointer Dereference via PNM third-party-advisory