CVE-2026-93586

LOWCVSS 2.9/10

Last modified

CVE-2026-93586 is a low-severity vulnerability rated 2.9/10 on the CVSS scale. ImageMagick before 7.1.2-31 and before 6.9.13-56 contains a use-after-free vulnerability in the ImagesToBlob method, caused by a pointer that is not updated correctly. Exploitation may result in a limited availability impact (e.g., a crash of the affected process).

Description

ImageMagick before 7.1.2-31 and before 6.9.13-56 contains a use-after-free vulnerability in the ImagesToBlob method, caused by a pointer that is not updated correctly. Exploitation may result in a limited availability impact (e.g., a crash of the affected process). The issue is fixed in versions 7.1.2-31 and 6.9.13-56.

Metrics

Weakness Enumeration

Affected Software

Source: CNA advisory (CVE.org). NVD analysis pending.

VendorProductVersions
ImageMagickImageMagick< 7.1.2-31
ImageMagickImageMagick< 6.9.13-56

References

Timeline

Published
Last Modified
Status
Received

Frequently Asked Questions

What is CVE-2026-93586?
ImageMagick before 7.1.2-31 and before 6.9.13-56 contains a use-after-free vulnerability in the ImagesToBlob method, caused by a pointer that is not updated correctly. Exploitation may result in a limited availability impact (e.g., a crash of the affected process). The issue is fixed in versions 7.1.2-31 and 6.9.13-56.
How severe is CVE-2026-93586?
CVE-2026-93586 has a CVSS score of 2.9/10 (LOW severity).
How do I fix CVE-2026-93586?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

How Strix Helps

Related CVEs from 2026

Are you affected by CVE-2026-93586?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST