This page tracks the Ubuntu fix status. The vulnerability itself is described on the main CVE page.
View CVE-2026-93588 →
UBUNTU-CVE-2026-93588
ImageMagick before 7.1.2-31 and before 6.9.13-56 contains a NULL pointer dereference in the PNM coder. When the coder reaches a memory (resource) limi...
Original description
The description as published by the source.
ImageMagick before 7.1.2-31 and before 6.9.13-56 contains a NULL pointer dereference in the PNM coder. When the coder reaches a memory (resource) limit at a specific point during processing, the failed allocation is not handled and a NULL pointer is dereferenced, which can lead to a denial of service (application crash) when processing a specially crafted or sufficiently large PNM image.
Source: OSV.dev (Open Source Vulnerabilities) OSV
Affected packages
Ubuntu:Pro:20.04:LTS
imagemagick
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8:6.9.10.23+dfsg-2.1ubuntu11.11+esm16"}]}]
Ubuntu:Pro:22.04:LTS
imagemagick
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8:6.9.11.60+dfsg-1.3ubuntu0.22.04.5+esm16"}]}]
Ubuntu:Pro:24.04:LTS
imagemagick
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8:6.9.12.98+dfsg1-5.2ubuntu0.1~esm15"}]}]
Ubuntu:Pro:26.04:LTS
imagemagick
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8:7.1.2.18+dfsg1-1ubuntu0.1~esm4"}]}]
References
- advisory ubuntu.com
- report ubuntu.com
- report cve.org
- report github.com
- report vulncheck.com