ImageMagick CVE-2026-109262

Exploitation requires that the target application invoke ImageMagick's SVG ENCODER - i.e., write/convert an image to SVG output (WriteSVGImage) - which is the key limiting factor: deployments that only read SVG or never emit SVG are not affected. The crafted input must drive the encoder into one of the two patched error conditions - unbalanced graphic-context push/pop ('UnbalancedGraphicContextPushPop') or vector graphics nested too deeply ('VectorGraphicsNestedTooDeeply') - where the pre-patch code threw the writer exception without freeing the 'token' string and 'primitive_info' buffer. Further limiting realistic risk: each trigger leaks only a bounded amount of memory, so a practical denial of service needs repeated/high-volume processing to exhaust host memory; no authentication or user interaction is required where such an SVG-output path is exposed. Affected versions: ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32.

This is a moderate, availability-only issue that should be patched during normal cycles rather than treated as an emergency. The input CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L) scores 6.9 and indicates a remotely reachable, unauthenticated, low-complexity flaw with LOW availability impact and zero confidentiality or integrity impact - consistent with CWE-401 (memory leak) and the DoS characterization. No EPSS score, KEV listing, or POC was provided; per the available signals this is 'no public exploit identified at time of analysis.' The signals are internally consistent (no KEV/POC to contradict the modest CVSS), so there is no conflict to flag, but note a nuance the raw CVSS obscures: the leak is in the SVG ENCODER (WriteSVGImage, the output/write path), so network exploitability only materializes where the target application actually converts images TO SVG - a meaningful real-world limiter not captured by AV:N alone. A single trigger leaks a bounded amount of memory (a token string plus the primitive_info buffer), so denial of service requires repeated, sustained processing to exhaust memory. Verdict: real but low-urgency; the 6.9 overstates practical risk for deployments that do not emit SVG output.

An attacker uploads a crafted image to a web service that uses ImageMagick to convert uploaded files into SVG output. Each conversion drives the SVG encoder down an error path (unbalanced graphic-context push/pop or excessively nested vector graphics) that abandons allocated memory; by submitting many such files the attacker steadily grows the process's memory footprint until the service degrades or is OOM-killed. No public exploit code was provided, and the technical impact is limited to availability.