ImageMagick CVE-2026-109272

Exploitation requires ImageMagick (7.1.1-31 up to but not including 7.1.2-32) to process an attacker-supplied PostScript (PS/EPS) file through its PostScript decoder (coders/ps.c), AND a policy limit must be reached during decoding to trigger the NULL pointer dereference - this policy-limit precondition is reflected by AT:P in the CVSS 4.0 vector and is the key limiting factor. Deployments without restrictive policy.xml resource limits, or that do not route untrusted files through the PostScript coder (e.g., PS/EPS disabled in policy.xml), are less likely to be reachable. Impact is limited to a process crash (denial of service); there is no confidentiality, integrity, or code-execution impact, and no authentication or user interaction is required when the service accepts untrusted input.

This is a limited-impact availability-only vulnerability that should be treated as low-to-moderate priority despite the 6.3 CVSS score. The CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:N/UI:N) describes a network-reachable, unauthenticated issue, but the only impact metric set is VA:L - there is no confidentiality or integrity impact, and no code execution (CWE-476 NULL pointer dereference, crash only). The AT:P (attack requirements present) metric is significant: exploitation depends on a specific precondition - a policy limit being reached during PostScript decoding - rather than firing against any input, which materially reduces real-world exploitability. No EPSS score was provided in the input, and the vulnerability is NOT listed in CISA KEV; no public exploit code was supplied, so this is 'no public exploit identified at time of analysis.' No SSVC decision data was provided. Signals are internally consistent: a genuine but low-severity DoS. Note the CVSS vector supplied is CVSS 4.0, not 3.1, and AV:N assumes ImageMagick is exposed to attacker-supplied files via a network-facing service (e.g., an upload/processing pipeline); in a purely local CLI context the practical attack vector is narrower - verify against deployment.

An attacker uploads a crafted PostScript (PS/EPS) file to a web application or service that uses ImageMagick for image conversion or thumbnailing. When ImageMagick's PostScript decoder hits a configured policy limit while processing the file, a NULL pointer dereference crashes the worker process, denying service to legitimate users. No public exploit code was identified in the provided data, and the attack requires the policy-limit precondition (AT:P) to be met.