ImageMagick CVE-2026-102635

Exploitation requires that a target service decode an attacker-supplied GIF with a vulnerable ImageMagick (before 7.1.2-32 / 6.9.13-57) AND that the resulting image metadata/profile (where the uninitialized heap bytes are stored) be returned or made readable to the attacker - a metadata-preserving conversion or an interface that echoes profiles. Limiting factors: the disclosure is opportunistic (attacker cannot choose which heap contents leak), impact is confidentiality-only and partial (VC:L), and the vendor's AC:H/AT:P reflect that reliable, useful extraction is non-trivial. Services that strip metadata on output, or that never expose the processed image's profiles, are effectively not exploitable even while running vulnerable code.

This is a genuine but low-severity information-disclosure flaw, not a critical priority. The vendor CVSS 4.0 vector (AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N) scores 6.3 but the impact is confined to VC:L - a partial disclosure of uninitialized heap contents with no integrity or availability impact. The AC:H and AT:P metrics are important limiting signals: successful, useful exploitation requires attacker-controlled conditions and is non-deterministic (heap contents are opportunistic, not reliably chosen), so the practical value to an attacker is modest. No EPSS score, no CISA KEV listing, and no public exploit were provided, so this is 'no public exploit identified at time of analysis.' The realistic risk is elevated only by ImageMagick's enormous deployment footprint in image-processing pipelines (server-side upload handling), which turns a low-severity leak into a broad attack surface. Net: a real bug worth patching on exposed image-processing services, but not an emergency. Note the 6.3 CVSS 4.0 score visually overstates urgency relative to the confidentiality-only, high-complexity reality.

An attacker uploads a crafted GIF containing a malformed application-extension block to a web service that processes images with ImageMagick. The GIF decoder's number parser in coders/gif.c reads uninitialized heap memory and stores it as image metadata (a generic profile), which the attacker then retrieves from the processed/returned output to recover sensitive adjacent heap bytes. No public POC was provided, and the high attack complexity means each attempt yields only opportunistic heap fragments.