CVE-2026-93590

A flaw was found in ImageMagick's UHDR encoder. This vulnerability allows a remote attacker to bypass resource policies by processing specially crafted UHDR images. The flaw occurs because the encoder fails to perform necessary policy checks during buffer allocation for image pixels, potentially leading to a Denial of Service (DoS) through excessive memory allocation.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this issue, restrict ImageMagick's ability to process UHDR images by modifying the policy.xml configuration file. Add a policy entry to deny the UHDR coder, for example: <policy domain="coder" rights="none" pattern="UHDR" />. This change may require a service restart for applications that use ImageMagick to take effect and may impact functionality relying on UHDR image processing. Additionally, it is recommended to avoid processing untrusted image files with ImageMagick.