ImageMagick CVE-2026-106576

Requires the target to parse an attacker-supplied image whose embedded XMP profile contains a crafted rational (numerator/denominator) value, triggering GetXmpNumeratorAndDenominator() in MagickCore/profile.c on versions prior to 7.1.2-31. No special configuration, authentication, or user interaction is required (PR:N/UI:N) against default ImageMagick XMP handling - the limiting factor is simply that the application must feed attacker-controlled image data through ImageMagick (e.g. an upload/convert/thumbnail pipeline). Impact is bounded to availability degradation (resource consumption); there is no memory corruption, data disclosure, or code execution, and the attack must reach a code path that reads XMP profiles.

This is a moderate-severity, single-impact denial-of-service issue, correctly scored at CVSS 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L). The signals are internally consistent: network-reachable, no authentication, no user interaction, but availability-only impact rated Low - there is no confidentiality or integrity exposure and no code execution. The commit evidence confirms the mechanism: the pre-fix GetXmpNumeratorAndDenominator() used an unbounded incremental search (while loop with no iteration cap) to approximate a rational numerator/denominator, so a crafted XMP value could force excessive CPU work (CWE-400 uncontrolled resource consumption); the fix replaces this with a continued-fraction algorithm hard-capped at 128 iterations. No EPSS score, KEV listing, or public POC was provided in the input, so there is no evidence of active exploitation or weaponization - this is a priority proportional to a resource-exhaustion bug, not a critical emergency. The real-world weight comes from prevalence rather than severity: ImageMagick is extremely widely deployed in server-side image pipelines that routinely process untrusted uploads, which raises exposure even though the worst case is service degradation rather than compromise. No conflicting signals were found; the only gap is the absence of exploitation-probability telemetry (EPSS/KEV), which should be treated as unknown rather than low.

An attacker uploads or submits an image containing a crafted XMP profile to a web application or service that uses ImageMagick for thumbnailing, conversion, or metadata extraction. When ImageMagick parses the malicious rational value in the XMP profile, the pre-7.1.2-31 approximation loop performs excessive iterations, consuming CPU and stalling or exhausting the worker handling the request. No public exploit was identified in the provided data, but the vulnerable code path is confirmed by the referenced vendor commit.