CVE-2026-56367, CVE-2026-93586, CVE-2026-93587 +3 more CVEs: imagemagick before 6.9.13-56 (exclusive), from 7.0.0-0 (inclusive), before 7.1.2-31 (exclusive)…

CVE-2026-56367, CVE-2026-93586, CVE-2026-93587, CVE-2026-93588, CVE-2026-93589, CVE-2026-93590 affects imagemagick. EPSS 0.00236 (percentile 0.13698), scored 21-Oct-2026. Fixed version: 8:6.7.7.10-6ubuntu3.13+esm27. Fixed version: 8:6.8.9.9-7ubuntu5.16+esm26. Fixed version: 8:6.9.7.4+dfsg-16ubuntu6.15+esm18. Fixed version: 8:6.9.10.23+dfsg-2.1ubuntu11.11+esm16. Fixed version: 8:6.9.11.60+dfsg-1.3ubuntu0.22.04.5+esm16. Fixed version: 8:6.9.12.98+dfsg1-5.2ubuntu0.1~esm15. Fixed version: 8:7.1.2.18+dfsg1-1ubuntu0.1~esm4.

CVE-2026-56367

Affected technology

Product not specified by the source · Exact affected versions not specified by the source
Vendor not specified by the source

Component: Not specified by the source

What an attacker can do

The source does not specify what an attacker can achieve.

CVE-2026-93586

Affected technology

imagemagick · before 6.9.13-56 (exclusive)
imagemagick

imagemagick · from 7.0.0-0 (inclusive), before 7.1.2-31 (exclusive)
imagemagick

ImageMagick · 0 to before 7.1.2-31
ImageMagick

ImageMagick · 0 to before 6.9.13-56
ImageMagick

Description’s affected range: before 7.1.2-31 and before 6.9.13-56

Component: Not specified by the source

Attack conditions (Vendor/CNA, CVSS 4.0): Local · No privileges required · No user interaction required

What an attacker can do

Vendor/CNA’s CVSS 4.0 assessment (base score 2.1/10) rates confidentiality and integrity impact as none; availability impact as low. The description does not specify what an attacker can achieve beyond these rated impacts.

CVE-2026-93587

Affected technology

imagemagick · before 6.9.13-56 (exclusive)
imagemagick

imagemagick · from 7.0.0-0 (inclusive), before 7.1.2-31 (exclusive)
imagemagick

ImageMagick · 0 to before 7.1.2-31
ImageMagick

ImageMagick · 0 to before 6.9.13-56
ImageMagick

Description’s affected range: before 7.1.2-31 and before 6.9.13-56

Component: Not specified by the source

Attack conditions (Vendor/CNA, CVSS 4.0): Local · Low privileges required · No user interaction required

What an attacker can do

Vendor/CNA’s CVSS 4.0 assessment (base score 4.8/10) rates confidentiality and integrity impact as none; availability impact as low. The description does not specify what an attacker can achieve beyond these rated impacts.

CVE-2026-93588

Affected technology

imagemagick · before 6.9.13-56 (exclusive)
imagemagick

imagemagick · from 7.0.0-0 (inclusive), before 7.1.2-31 (exclusive)
imagemagick

ImageMagick · 0 to before 7.1.2-31
ImageMagick

ImageMagick · 0 to before 6.9.13-56
ImageMagick

Description’s affected range: before 7.1.2-31 and before 6.9.13-56

Component: Not specified by the source

Attack conditions (Vendor/CNA, CVSS 4.0): Network (remote) · Low privileges required · No user interaction required

What an attacker can do

The source reports that an attacker could disrupt service under the conditions described by the source. Vendor/CNA’s CVSS 4.0 assessment (base score 2.3/10) rates confidentiality and integrity impact as none; availability impact as low.

CVE-2026-93589

Affected technology

imagemagick · before 6.9.13-56 (exclusive)
imagemagick

imagemagick · from 7.0.0-0 (inclusive), before 7.1.2-31 (exclusive)
imagemagick

ImageMagick · 0 to before 7.1.2-31
ImageMagick

ImageMagick · 0 to before 6.9.13-56
ImageMagick

Description’s affected range: before 7.1.2-31 and 6.9.13-56

Component: Not specified by the source

Attack conditions (Vendor/CNA, CVSS 4.0): Network (remote) · No privileges required · No user interaction required

What an attacker can do

The source reports that an attacker could disrupt service. Vendor/CNA’s CVSS 4.0 assessment (base score 6.3/10) rates confidentiality and integrity impact as none; availability impact as low.

CVE-2026-93590

Affected technology

imagemagick · before 7.1.2-31 (exclusive)
imagemagick

ImageMagick · 0 to before 7.1.2-31
ImageMagick

Description’s affected range: before 7.1.2-31

Component: Not specified by the source

Attack conditions (Vendor/CNA, CVSS 4.0): Network (remote) · No privileges required · No user interaction required

What an attacker can do

Attackers can bypass resource policies by processing specially crafted UHDR images, potentially causing denial of service through excessive memory allocation. Vendor/CNA’s CVSS 4.0 assessment (base score 6.3/10) rates confidentiality and integrity impact as none; availability impact as low.

Published 22-Oct-2026 20:43 UTC

CVE: CVE-2026-93588, CVE-2026-93589, CVE-2026-93590
CWE: CWE-369, CWE-400, CWE-416, CWE-476
Product: imagemagick
CCR priority: 0.1 /100 (P5)
EPSS: 0.00236 · percentile 0.13698 · 2026-10-21
KEV: no

Provenance

OSV.dev · Source record · observed 2026-10-22 12:21:37.944032+00:00 UTC

Stable permalink: https://cybercodered.org/item/cve-cve-2026-56367.html