What is GHSA-738c-v4gv-hcp2?

GHSA-738c-v4gv-hcp2 is a security advisory published by GitHub Security Advisories with Medium severity. ImageMagick before 7.1.2-31 contains a policy bypass vulnerability in the UHDR encoder that fails...

Which CVE IDs does GHSA-738c-v4gv-hcp2 cover?

GHSA-738c-v4gv-hcp2 covers the following CVE IDs: CVE-2026-93590. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-738c-v4gv-hcp2?

GHSA-738c-v4gv-hcp2 has a CVSS v3 base score of 3.7, published by GitHub Security Advisories.

GHSA-738c-v4gv-hcp2MediumCVSS 3.7

ImageMagick before 7.1.2-31 contains a policy bypass vulnerability in the UHDR encoder that fails...

Vendor

GitHub Security Advisories

Published

September 18, 2026

Last Modified

September 18, 2026

🔗 CVE IDs covered (1)

CVE-2026-93590 →

📋 Description

ImageMagick before 7.1.2-31 contains a policy bypass vulnerability in the UHDR encoder that fails to perform policy checks during buffer allocation for image pixels. Attackers can bypass resource policies by processing specially crafted UHDR images, potentially causing denial of service through excessive memory allocation.

🔗 References (4)

https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-7hjx-392p-f8cm
https://nvd.nist.gov/vuln/detail/CVE-2026-93590
https://www.vulncheck.com/advisories/imagemagick-before-7.1.2-31-policy-bypass-in-uhdr-encoder
https://github.com/advisories/GHSA-738c-v4gv-hcp2