Executive brief
ImageMagick is a widely-used open-source library for image manipulation used by web applications, content management systems, and other software. A use-after-free vulnerability in the ImagesToBlob method can cause the application to crash when processing specially-crafted image data, leading to denial of service and potential service unavailability.
Technical details
A use-after-free vulnerability (CWE-416) exists in ImageMagick's ImagesToBlob method where a pointer is not updated correctly after memory is freed, allowing it to be dereferenced in subsequent operations. The vulnerability requires local access and is triggered through specific image processing operations with high attack complexity. Exploitation results in a crash of the affected process, providing a limited availability impact with no confidentiality or integrity impact. The issue is fixed in ImageMagick versions 7.1.2-31 and 6.9.13-56.
Affected products
- ImageMagick ImageMagick before 7.1.2-31 and before 6.9.13-56
Timeline
- 2026-09-03: disclosed: GitHub security advisory published
- 2026-09-18: advisory: CVE-2026-93586 published
- 2026-09-03: patched: Fixed in versions 7.1.2-31 and 6.9.13-56