ImageMagick < 7.1.2-31 UHDR Encoder Policy Bypass

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(362652);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/10/02");

  script_cve_id("CVE-2026-93590");

  script_name(english:"ImageMagick < 7.1.2-31 UHDR Encoder Policy Bypass");

  script_set_attribute(attribute:"synopsis", value:
"The remote host has an application installed that is affected by a policy bypass vulnerability.");
  script_set_attribute(attribute:"description", value:
"The remote host has a version of ImageMagick installed that is prior to 7.1.2-31. It is, therefore, affected by a
vulnerability.

  - ImageMagick before 7.1.2-31 contains a policy bypass vulnerability in the UHDR encoder that fails to perform
    policy checks during buffer allocation for image pixels. Attackers can bypass resource policies by processing
    specially crafted UHDR images, potentially causing denial of service through excessive memory
    allocation. (CVE-2026-93590)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version
number.");
  # https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-7hjx-392p-f8cm
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?b6d44e66");
  script_set_attribute(attribute:"solution", value:
"Upgrade to ImageMagick version 7.1.2-31 or later.");
  script_set_attribute(attribute:"agent", value:"all");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:H/Au:N/C:N/I:N/A:P");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-93590");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/09/03");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/09/03");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/10/02");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:imagemagick:imagemagick");
  script_set_attribute(attribute:"thorough_tests", value:"true");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Misc.");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("imagemagick_installed.nasl", "imagemagick_macos_installed.nbin", "imagemagick_nix_installed.nbin");
  script_require_keys("installed_sw/ImageMagick");

  exit(0);
}

include('vdf.inc');

# @tvdl-content
var vuln_data = {
  'metadata': {'spec_version': '1.0'},
  'checks': [
    {
      'check_algorithm': 'default',
      'product': {'name': 'ImageMagick', 'type': 'app'},
      'constraints': [
        { 'fixed_version' : '7.1.2.31', 'fixed_display' : '7.1.2-31' }
      ]
    }
  ]
};

var result = vdf::check_and_report(vuln_data:vuln_data, severity:SECURITY_NOTE);
vdf::handle_check_and_report_errors(vdf_result:result);