ImageMagick CVE-2026-106564

Exploitation requires that the target application pass an attacker-controlled EXR (OpenEXR) file to ImageMagick's EXR coder (coders/exr.c), which in turn requires an ImageMagick build with EXR/OpenEXR delegate support enabled - EXR is not a universally enabled format. No authentication or user interaction is needed if the consuming service accepts user-supplied images (e.g., an upload/thumbnailing endpoint). Limiting factors: the vulnerability is only reachable where EXR decoding is enabled and exposed to untrusted input, and the realistic outcome is a single-process crash rather than code execution or data exposure; affected versions are those prior to 7.1.2-32.

This is a moderate-to-low priority denial-of-service issue, not a high-impact vulnerability. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L, base 5.3 MEDIUM) shows the only impact is availability (A:L) - a process crash - with no confidentiality or integrity loss, which is consistent with CWE-122 (heap buffer overflow) that the vendor describes as causing a crash rather than code execution. Although the vector is AV:N/PR:N (reachable by an unauthenticated remote attacker), exploitation depends on the target application feeding attacker-supplied images through ImageMagick's EXR decoder. No EPSS score, KEV listing, or SSVC decision data was provided in the input, and there is no public exploit identified at time of analysis; a vendor patch commit diff exists but that is remediation evidence, not exploit code. Note a residual uncertainty: the description says the decoder can 'write beyond a heap buffer,' and heap out-of-bounds writes can sometimes escalate beyond a crash, but the vendor scored impact as availability-only (A:L) - defenders should treat it as a DoS unless the vendor revises the assessment.

An attacker uploads or submits a crafted EXR image to a web service or pipeline that uses ImageMagick for image processing. When the EXR decoder parses the malformed file, it writes past the end of a heap buffer and the ImageMagick process crashes, disrupting the service for other users. No public exploit code was identified at time of analysis, though the upstream fix commit is published.