ImageMagick CVE-2026-116153

Exploitation requires a 32-bit build of ImageMagick - the vendor advisory states '32-bit builds only', so 64-bit deployments (the modern norm) are not affected. The attacker must get a crafted image processed in a workflow that requests convex-hull information (-convex-hull / connected-components or morphology path invoking convex-hull), so the specific feature must be exercised. Limiting factors: 32-bit-only scope drastically narrows the exposed population; high attack complexity (AC:H) and a specific attack requirement (AT:P); and passive user interaction (UI:P) meaning a victim must process the attacker-supplied input. Impact is scoped to availability (crash) per the CVSS vector; code execution is described only as 'potential' and is not confirmed.

Signals converge on LOW real-world priority despite ImageMagick's broad footprint. The vendor CVSS 4.0 vector (AV:L/AC:H/AT:P/PR:N/UI:P) scores only 2.0 and limits impact to low availability (VC:N/VI:N/VA:L) - i.e., a crash, not demonstrated code execution. This conflicts with the 'RCE' tag and the description's 'potential code execution' language; the quantitative assessment does NOT support confirmed remote code execution, and this should be verified before treating it as an RCE. Exploitation is further gated by two strong limiters: it affects 32-bit builds ONLY (the vendor advisory is explicit: '32-bit builds only'), and it requires high attack complexity plus a specific attack requirement (AT:P) and victim-side action to request convex-hull processing. EPSS is not provided, the CVE is NOT in CISA KEV, and no public exploit was identified. The vuln.today decision label is 'monitor' (not act_now/emergency), consistent with the low score. Net: this is a high-ceiling product but a low-likelihood, low-impact-as-scored issue - most modern 64-bit deployments are unaffected entirely. Patch when convenient per normal cadence rather than as an emergency.

An attacker supplies a crafted image to a 32-bit ImageMagick instance whose workflow requests convex-hull information; the integer overflow (CWE-190) leads to a heap buffer over-write, crashing the process or, as the vendor notes, potentially enabling code execution. The CVSS vector marks this local (AV:L), high-complexity (AC:H) with an attack requirement (AT:P) and passive user interaction (UI:P), so it is not a straightforward remote exploit. No public exploit identified at time of analysis; the listed references are vendor advisories, not exploit code.