ImageMagick CVE-2026-109270

Requires the ability to execute the ImageMagick command-line utility (e.g. magick/convert) and to control the arguments passed to its -process option, which triggers the leaky code path in CLIListOperatorImages. Exploitation is strictly LOCAL (AV:L) and requires at least low-level privileges (PR:L) to run the tool, so it applies to local users or to applications that expose ImageMagick CLI invocation with attacker-influenced -process arguments. Limiting factors: the attack is not remote or unauthenticated, memory exhaustion is gradual and requires repeated invocation to cause meaningful service degradation, impact is confined to availability with no data exposure or code execution, and only versions before 7.1.2-32 are affected.

This is a medium-severity resource-exhaustion issue (CVSS 4.0 base 4.8) whose signals point consistently toward low real-world urgency rather than a high-priority flaw. The vendor-provided CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:L/UI:N) describes a LOCAL, low-complexity attack requiring at least low privileges and no user interaction, with impact confined to availability (VA:L) and no confidentiality or integrity impact (VC:N/VI:N) - consistent with the CWE-401 memory-leak classification and the description's 'degrade service availability' outcome. Exploitation status is 'no public exploit identified at time of analysis': the input provides no KEV listing, no POC flag, and no EPSS score, so exploitation probability cannot be quantified from the data. The one notable conflict is the 'Information Disclosure' tag, which contradicts both the CWE (memory leak → availability) and the CVSS impact metrics (VC:N) - this appears to be a mislabeling and should not be read as evidence of data exposure. The source-code diff independently corroborates the root cause: the patch adds a DestroyArguments macro to free the parsed argument array on error/exit paths in CLIListOperatorImages, confirming unreleased allocations in the -process argument handling. Net assessment: a genuine but low-impact local denial-of-service requiring repeated invocation; not an urgent patch priority for most environments, though EPSS is MISSING and cannot be used to confirm this independently.

An attacker who can invoke the ImageMagick command-line tool (directly as a local user, or indirectly via a service that forwards attacker-influenced arguments) repeatedly calls the -process option with crafted arguments that trigger the leaky error path. Each invocation leaks the parsed argument buffers, and sustained repetition gradually exhausts available memory and degrades or denies service. No public exploit code was identified in the provided data.