Executive brief
ImageMagick is a widely-used image manipulation library that supports dozens of image formats, including FLIF (Free Lossless Image Format). A malformed FLIF image with an incorrect ticks-per-second value can trigger a division-by-zero error in the encoder, causing the ImageMagick process to crash. This results in denial of service for any application using ImageMagick to process untrusted images.
Technical details
This vulnerability is a divide-by-zero flaw (CWE-369) in ImageMagick's FLIF encoder. The root cause is improper validation of the ticks-per-second value in FLIF image metadata before performing arithmetic operations. An attacker can craft a malicious FLIF file with a zero or invalid ticks value to trigger the crash. The attack requires network access to provide the malicious image file to an application using ImageMagick, but does not require authentication or user interaction. The impact is limited to availability (process crash); no data confidentiality or integrity is affected. Patches are available in versions 7.1.2-31 and 6.9.13-56.
Affected products
- ImageMagick ImageMagick before 7.1.2-31 and 6.9.13-x before 6.9.13-56
Timeline
- 2026-09-03: disclosed: GitHub security advisory published
- 2026-09-18: advisory: CVE-2026-93589 published
- 2026-09-03: patched: Patches released: 7.1.2-31 and 6.9.13-56