ImageMagick CVE-2026-109279

Exploitation requires local access and the ability to induce concurrent access to the ImageMagick security policy - specifically simultaneous reads and writes of the policy (e.g. via SetMagickSecurityPolicy) across multiple threads within a process embedding the library. The flaw lives in the unsynchronized policy_semaphore-guarded region of MagickCore/policy.c (magick/policy.c for ImageMagick6). Limiting factors: the attacker must already have local low-privileged code execution (PR:L, AV:L), the target application must perform multi-threaded policy modification at runtime (not a default for most single-policy deployments, which load policy once at startup), and success depends on winning a probabilistic timing race (AT:P), making reliable triggering non-trivial. Impact is limited to a crash - no confidentiality or integrity effect.

This is a genuinely low-priority issue despite being a memory-corruption bug. The CVSS 4.0 vector (AV:L/AC:L/AT:P/PR:L/UI:N) and the vendor-assigned base score of 2.0 align consistently: exploitation is local, requires low privileges (PR:L), and carries an Attack Requirement (AT:P) reflecting the non-deterministic timing window inherent to a race condition. Impact is confined to availability (VA:L) with no confidentiality or integrity consequence - the outcome is an application crash (DoS), not code execution, despite the underlying heap buffer over-write. No EPSS score, KEV listing, or public POC is present in the provided data, so there is no evidence of exploitation: no public exploit identified at time of analysis. The signals are internally consistent and do not conflict - a race-condition DoS requiring local concurrent access to the security policy is a robustness/hardening fix, not an urgent threat. Note the CVSS 4.0 vector uses AC:L with AT:P to model the race timing; a CVSS 3.1 translation would more naturally render this as AC:H since 3.1 has no Attack Requirement metric.

A local, low-privileged user (or co-tenant process) interacts with a multi-threaded application embedding ImageMagick and induces simultaneous reads and writes of the security policy across threads. By repeatedly triggering concurrent SetMagickSecurityPolicy calls alongside policy reads, the attacker hits the unsynchronized window and corrupts the heap, crashing the process. No public exploit code is identified; the low attack complexity is offset by the probabilistic race window (AT:P).