ImageMagick CVE-2026-53466

The vulnerable code path requires that the target system invoke the ImageMagick XCF image decoder on attacker-controlled input - meaning the application must accept XCF-format files, or lack format validation that would block them before decoding. Services that only accept JPEG or PNG and reject unrecognized formats are not exposed. The CVSS vector AV:N/AC:L/PR:N/UI:N/S:U indicates that beyond supplying the crafted file, no special configuration, privileged account, victim interaction, or race condition is required. Exploitation is limited by: (1) whether the target application permits XCF file submission or lacks pre-decode format filtering; (2) whether ImageMagick is sandboxed, limiting crash impact to the sandboxed process; and (3) the absence of currently known public exploit code, which raises the practical effort required to move from crash to controlled memory disclosure.

The NVD-assigned CVSS 3.1 score of 6.5 (Medium) with vector AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L accurately characterizes the attack surface: the flaw is reachable over a network with no authentication, no user interaction, and low attack complexity, making it broadly automatable. The impact is constrained to partial confidentiality loss (out-of-bounds read may expose adjacent heap or stack bytes) and partial availability loss (crash). ImageMagick is frequently embedded in web applications, CMS platforms, and CI pipelines as a server-side image processor, so the effective attack surface is high wherever untrusted image uploads are accepted. No EPSS score was supplied in the input data and must be independently verified. KEV status is negative - CISA has not confirmed active exploitation - and no POC code has been identified, which meaningfully reduces near-term risk compared to the network-accessible, low-complexity surface might otherwise suggest. The primary real-world risk is a denial-of-service crash loop against services that process XCF files without sandboxing ImageMagick, with secondary risk of minor memory disclosure if the read lands on sensitive heap regions. This is a patch-and-move-on priority rather than an emergency response.

An attacker submits a specially crafted XCF image file to a web application, API endpoint, or image-processing pipeline that passes user-supplied files to ImageMagick. The malformed XCF triggers the integer overflow in the decoder, which causes an out-of-bounds read - either crashing the ImageMagick worker process (denial of service) or, in a more targeted scenario, leaking a small region of heap memory that could contain session tokens or other sensitive data processed nearby. No public exploit code has been identified at time of analysis, but the AV:N/AC:L/PR:N/UI:N surface means any actor who can submit an image file can attempt exploitation without specialized tooling.