ImageMagick CVE-2026-109265

Exploitation requires that the target application or service actually parse an attacker-supplied image file containing a malformed XMP profile (a string that is not correctly terminated) using a vulnerable ImageMagick build in the 7.1.1-7 through pre-7.1.2-32 range - e.g. any upload/thumbnailing/conversion pipeline that feeds untrusted images into ImageMagick. Limiting factors: the deployment must process untrusted images, must be running an affected version, and the realistic outcome is a process crash (denial of service) rather than code execution or confirmed data disclosure, which caps the practical severity.

This is a moderate, not top-tier, priority. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes a network-reachable, low-complexity, unauthenticated trigger, which sounds serious, but the impact metrics tell the real story: VC:N/VI:N/VA:L means the only assessed impact is partial availability loss - i.e. an application crash (denial of service), with no confidentiality or integrity impact. The 6.9 score is driven by easy triggerability against a widely-deployed component, not by a severe outcome. Note a tension worth verifying: CWE-125 (out-of-bounds read) and the 'Information Disclosure' tag imply potential memory disclosure, yet the vendor-assigned vector sets VC:N, indicating the over-read manifests as a crash rather than attacker-readable data leakage - treat 'information disclosure' as unconfirmed and the realistic outcome as DoS. No EPSS score, no CISA KEV listing, and no public exploit were provided, so there is no public exploit identified at time of analysis and no evidence of active or automated exploitation. Overall: a patch-worthy DoS bug in a high-footprint library, but absent exploitation signals it is a routine-prioritization issue rather than an emergency.

An attacker uploads or submits a crafted image whose XMP profile is malformed (incorrectly terminated string) to a service that processes images with a vulnerable ImageMagick version. When ImageMagick parses the XMP profile it reads past the end of the allocated heap buffer, crashing the process and denying service to legitimate users. No public exploit code was provided, and the assessed impact is a crash rather than confirmed data exfiltration.