ImageMagick CVE-2026-116150

Exploitation requires that the target application actually invokes ImageMagick's FPX (FlashPix) output encoder on attacker-supplied input - the leak is specific to the FPX encode path, not generic image handling, so deployments that never encode to FPX are not exposed. The attacker must also be able to submit images repeatedly, because a single request only leaks a small amount; denial of service depends on accumulating many encodes. Limiting factors: FPX is an obscure, rarely-enabled output format; high attack complexity (AC:H) and a present attack requirement (AT:P) per the vendor vector; and impact is confined to gradual availability degradation (VA:L) with no data compromise.

This is a low-priority, low-real-risk issue despite affecting a very widely deployed product. The vendor-supplied CVSS 4.0 vector (AV:N/AC:H/AT:P/PR:N/UI:P/VC:N/VI:N/VA:L) scores only 2.3, and the signals are internally consistent: the sole impact is a partial availability hit (VA:L) from a memory leak (CWE-401), with no confidentiality or integrity consequence. High attack complexity (AC:H) and a present attack requirement (AT:P) indicate exploitation is not reliable on a single request - it requires repeated crafted submissions to accumulate leaked memory into a denial of service. No EPSS score is present in the input and the CVE is not on CISA KEV, so there is no evidence of exploitation probability or active abuse; the vuln.today decision label is 'monitor', the lowest urgency tier, which aligns with the low CVSS and absence of exploitation signals. The only apparent tension is between ImageMagick's enormous deployment footprint and the low severity - but the footprint is offset by the obscure FPX (FlashPix) output path that most deployments never exercise. There is no conflicting data requiring vendor verification; the network vector is plausible because ImageMagick is commonly reached via image-upload/processing pipelines.

An attacker repeatedly submits crafted images to an internet-facing service that uses ImageMagick to encode output in the FPX (FlashPix) format; each encode leaks memory that is never freed. Sustained submissions gradually exhaust available memory on the host, degrading or crashing the image-processing service and producing a denial of service. No public exploit identified at time of analysis; success requires many repeated requests rather than a single payload (AC:H).