ImageMagick <7.1.2-31 or <6.9.13-56 NULL Deref DoS in PNM Coder
CVE-2026-93588 Published on September 18, 2026
ImageMagick before 7.1.2-31 Null Pointer Dereference via PNM
ImageMagick before 7.1.2-31 and before 6.9.13-56 contains a NULL pointer dereference in the PNM coder. When the coder reaches a memory (resource) limit at a specific point during processing, the failed allocation is not handled and a NULL pointer is dereferenced, which can lead to a denial of service (application crash) when processing a specially crafted or sufficiently large PNM image.
Vulnerability Analysis
CVE-2026-93588 is exploitable with network access, and requires small amount of user privileges. This vulnerability is consided to have a high level of attack complexity. The potential impact of an exploit of this vulnerability is considered to have no impact on confidentiality and integrity and availability.
Weakness Type
NULL Pointer Dereference
A NULL pointer dereference occurs when the application dereferences a pointer that it expects to be valid, but is NULL, typically causing a crash or exit. NULL pointer dereference issues can occur through a number of flaws, including race conditions, and simple programming omissions.
Products Associated with CVE-2026-93588
Want to know whenever a new CVE is published for ImageMagick? stack.watch will email you.
Affected Versions
ImageMagick:- Before 7.1.2-31 is affected.
- Version 7.1.2-31 is unaffected.
- Before 6.9.13-56 is affected.
- Version 6.9.13-56 is unaffected.