ImageMagick CVE-2026-55595

Exploitation requires that the target system invokes ImageMagick with the -connected-components option supplied with invalid argument values; systems that do not use this specific feature are entirely unexposed. The CVSS vector specifies AV:L (local attack vector), meaning the attacker must either have local access to the system or control over input that reaches a locally-executed ImageMagick process. UI:R confirms that a user or automated process must actively trigger the ImageMagick invocation - passive network exposure is not possible. AC:H indicates that reaching the vulnerable code path is not trivial and requires crafting the specific invalid argument condition. PR:N means no authenticated session or privilege escalation is required to invoke ImageMagick itself. Exploitation is limited to denial of service (availability only); there is no path to code execution, data disclosure, or integrity compromise from this vulnerability alone.

The CVSS 3.1 vector AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H yields a Medium score of 4.7, reflecting a local attack vector with high complexity and required user interaction - conditions that substantially constrain the realistic threat surface. No EPSS score was provided in the input data, so exploitation probability cannot be quantified from that signal. The absence of a CISA KEV listing and the lack of any known public proof-of-concept further indicate this is not a priority for widespread exploitation campaigns. The impact is strictly availability (infinite CPU consumption); there is no confidentiality or integrity exposure. For organizations running ImageMagick in automated server-side pipelines where attacker-controlled input could reach the connected-components option, the effective risk is elevated above the raw CVSS score suggests, since the UI:R requirement may be satisfied by the pipeline itself rather than a human. For interactive CLI use by trusted users, risk is very low.

An attacker who can influence the arguments passed to an ImageMagick invocation - for example, through a web application that accepts user-defined image processing parameters - crafts an input that supplies invalid values to the -connected-components option. When the application processes the request, ImageMagick enters an infinite loop consuming 100% of the worker CPU, causing the image-processing worker to hang and degrading or denying service to other users of the same pipeline. No public proof-of-concept code is known at this time.