This page tracks the Debian fix status. The vulnerability itself is described on the main CVE page. View CVE-2026-93588 →

DEBIAN-CVE-2026-93588

ImageMagick before 7.1.2-31 and before 6.9.13-56 contains a NULL pointer dereference in the PNM coder. When the coder reaches a memory (resource) limi...

Original description

The description as published by the source.

ImageMagick before 7.1.2-31 and before 6.9.13-56 contains a NULL pointer dereference in the PNM coder. When the coder reaches a memory (resource) limit at a specific point during processing, the failed allocation is not handled and a NULL pointer is dereferenced, which can lead to a denial of service (application crash) when processing a specially crafted or sufficiently large PNM image.

Source: OSV.dev (Open Source Vulnerabilities) OSV

Affected packages

Debian:12 imagemagick

[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]

Debian:13 imagemagick

[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]

Debian:14 imagemagick

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8:7.1.2.31+dfsg1-1"}]}]

References

advisory security-tracker.debian.org