ImageMagick CVE-2026-106569

Exploitation requires the target to decode an attacker-supplied ASE (Adobe Swatch Exchange) image through ImageMagick prior to version 7.1.2-32 - i.e., the application must accept and process ASE input via a vulnerable build. The CVSS vector is PR:N/UI:N (unauthenticated), so no credentials are needed where such an upload/convert path is network-exposed; the limiting factors are that the application must actually invoke ImageMagick's ASE coder on untrusted data and must be running an unpatched version. Impact is confined to availability (process crash or long-running operation); there is no confidentiality or integrity effect and no cross-component scope change.

This is a moderate-severity, availability-only denial-of-service issue (CWE-770, uncontrolled resource consumption) in ImageMagick's ASE decoder, and the signals are internally consistent rather than conflicting. The vendor CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L, 5.3) correctly limits impact to availability with no confidentiality or integrity exposure; the underlying fix (replacing an in-place ResizeQuantumMemory with a bounded AcquireQuantumMemory plus guarded memcpy in ReadASELayerChunk) confirms the root cause is a memory/resource-handling flaw triggered by a crafted ASE file, not a code-execution primitive. No EPSS score, KEV listing, or POC was provided in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation. The practical risk is real but bounded: an attacker can crash a worker process or force a long-running operation, which matters for image-processing services that accept untrusted uploads, but the 'network' attack vector is contingent on the target application actually parsing attacker-supplied ASE input. Net assessment: a legitimate patch-management priority for high-throughput or multi-tenant image pipelines, but not a critical, drop-everything issue given the availability-only, scope-unchanged nature.

An attacker submits a specially crafted ASE (Adobe Swatch Exchange) image to an application or web service that uses ImageMagick to decode or convert uploaded files. Missing validation and resource checks in the ASE layer-chunk parser cause excessive memory handling or a long-running operation, crashing the worker or tying up server resources (a classic DoS). No public exploit code is identified in the provided data, so exploitation would require an attacker to craft the malformed ASE file themselves.