CVE-2026-93587

A flaw was found in ImageMagick. A local user, by supplying a specific command line option to the PCD, CUBE, or HALD image decoders, can bypass configured resource limits. This policy bypass allows for extra memory allocation, enabling the user to exceed the intended memory policy limit. The most significant consequence is a denial of service (DoS) due to uncontrolled resource consumption.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate the potential for denial of service, system administrators can enforce resource limits for users who execute ImageMagick. This can be achieved by setting appropriate ulimit values for memory consumption (e.g., as for virtual memory or rss for resident set size) in user login scripts or system-wide configuration files like /etc/security/limits.conf. For example, to limit virtual memory for a user, add a line such as username hard as 1048576 (1GB) to /etc/security/limits.conf. Changes to /etc/security/limits.conf require users to log out and back in to take effect and may impact other applications run by the user.