ImageMagick CVE-2026-109964

Exploitation requires (1) a 32-bit build of ImageMagick before 7.1.2-33 (v7) or 6.9.13-58 (v6) - 64-bit builds are NOT affected because the pointer-arithmetic overflow does not occur, and (2) the target must process an attacker-supplied PICT file whose row, column, and bytes-per-line values are maximized to defeat the bounds checks in DecodeImage(). The primary limiting factors are the 32-bit architecture dependency (increasingly uncommon in production servers), the high attack complexity of reliably shaping the heap, and the need for the application to accept and decode PICT input. No authentication is required per CVSS PR:N, and no user interaction is needed in automated image-processing pipelines.

This is a genuine but moderate-priority issue, not a top-tier emergency. The vendor-assigned CVSS 4.0 vector (AV:N/AC:H/AT:P/PR:N/UI:N) with a 6.3 base score correctly signals constrained real-world exploitability: although the attack vector is network-reachable and requires no privileges, the high attack complexity (AC:H) and present attack requirements (AT:P) reflect two hard gates - the target must be a 32-bit build, and the attacker must craft a PICT file with simultaneously maximized row, column, and bytes-per-line values to force the pointer-arithmetic overflow past the bounds checks. No EPSS score, no CISA KEV listing, and no public POC were provided, so there is no evidence of active or imminent exploitation; the reporting is from VulnCheck as a research disclosure rather than incident-driven. The 'RCE' tag and the description's 'code execution' language indicate worst-case potential, but the vendor rates each of confidentiality, integrity, and availability only Low (VC:L/VI:L/VA:L), implying that a controlled 128-byte heap underwrite most reliably yields crashes/DoS and that reliable code execution is not assumed. The most important caveat: this vulnerability is architecture-specific - 64-bit builds, which dominate modern server and desktop deployments, are not affected by the described pointer-arithmetic overflow, substantially shrinking the exposed population relative to ImageMagick's overall footprint.

An attacker uploads a malicious PICT image to a web application or service that uses a 32-bit ImageMagick build for server-side image processing (thumbnailing, conversion, metadata extraction). The crafted file sets maximized row, column, and bytes-per-line fields so DecodeImage() in coders/pict.c overflows pointer arithmetic and writes up to 128 attacker-controlled bytes below the heap buffer, most likely crashing the worker but potentially corrupting adjacent heap state toward code execution. No public exploit code was identified at time of analysis, and the high complexity plus 32-bit-only requirement make reliable exploitation difficult.