ImageMagick CVE-2026-109263

Exploitation requires that the target application invoke ImageMagick's YUV encoder - i.e., write/convert an image to the YUV output format (coders/yuv.c WriteYUVImage) - on attacker-influenced input; deployments that never produce YUV output are not exposed. Within that path, the attacker must craft input that makes a specific encoder operation fail (the fix shows leaks on the ResourceLimitError/ThrowWriterException failure branch and in chroma_image cleanup), and because each failure leaks only incrementally, a realistic denial of service requires repeated, high-volume triggering to exhaust memory (reflected by AT:P). Limiting factors: no authentication is required per PR:N, but the attack is gated by the non-default use of the YUV write path, the need to reliably force the failing operation, and the gradual/cumulative nature of the leak (availability-only, VA:L).

This is a medium-severity resource-exhaustion issue (CVSS 4.0 base 6.3) with impact confined entirely to availability (VC:N/VI:N/VA:L) - there is no confidentiality or integrity exposure and CWE-401 (missing memory release) confirms it is a memory leak, not code execution. The vendor CVSS vector is CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N, and the key tempering signal is AT:P (Attack Requirements: Present): exploitation is not a clean one-shot remote hit but depends on first forcing a specific YUV encoder operation to fail, then repeating it enough to exhaust memory. The 'potentially exhausting resources' language in the description underscores that a single request leaks only a small amount - a sustained, high-volume campaign is required for observable DoS. No EPSS score, KEV listing, or public POC was provided in the input, so exploitation status is: no public exploit identified at time of analysis. Net assessment: this is a real but modest-priority patch-management item - a classic 'high-enough-CVSS-but-low-real-risk' availability bug - that matters most to services that pipe untrusted images through ImageMagick's YUV output path and far less to typical deployments that never invoke that encoder. Patch promptly in exposed image-processing services; deprioritize relative to any RCE/memory-corruption ImageMagick issues.

An internet-facing service (e.g., an image-conversion API or upload pipeline) uses ImageMagick to write output in the YUV format. An attacker repeatedly submits crafted images designed to make the YUV encoder's allocation/validation step fail, and each failed operation leaks memory that is never freed; over many requests the process's memory footprint grows until the service degrades or crashes. No public exploit code was identified in the provided data, and the AT:P requirement means the attacker must reliably trigger the failing path at volume.