ImageMagick CVE-2026-56368

The target application must pass attacker-controlled image data to one of the ImageMagick coders that write raw pixel data - the specific coder names are not individually enumerated in available intelligence beyond 'coders that write raw pixel data.' No authentication is required (PR:N, UI:N per the CVSS 4.0 vector). However, the high attack complexity (AC:H) and partial attack requirements (AT:P) indicate that not all ImageMagick deployments are reachable under the exact conditions required - the attacker must trigger the specific vulnerable coder invocation path, likely tied to a particular image format or processing mode. Exploitation is not a single-shot crash but requires repeated image submissions to accumulate sufficient memory pressure for a noticeable denial of service. Limiting factors: deployments using container memory limits, ulimit constraints, or per-request process spawning significantly reduce impact even if the leak is triggered; environments that restrict accepted image formats to a safe allowlist may avoid invoking the vulnerable coders entirely; and the AC:H rating reduces the likelihood of automated mass exploitation.

The CVSS 4.0 vector AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N yields a score of 6.3, reflecting a meaningful but constrained threat. AC:H and AT:P together indicate that exploitation requires specific conditions - likely a particular image format or coder invocation path - making automated, indiscriminate exploitation unlikely. The impact is strictly limited to low availability on the vulnerable system with no confidentiality or integrity component. KEV status is not confirmed, and no public exploit code has been identified. EPSS data was not provided in available intelligence. The real-world priority is elevated for internet-facing image processing pipelines (e.g., user-upload endpoints, thumbnail generators) that pass untrusted content to ImageMagick without memory limits or process sandboxing, but is genuinely low for controlled internal deployments or those already operating under container memory constraints. No conflicting signals exist between the CVSS vector and the description - both indicate a network-reachable, unauthenticated, availability-only denial of service.

An attacker with access to an image upload endpoint submits a repeated sequence of specially crafted image files engineered to invoke one of the vulnerable raw-pixel-data coders, each causing a 160-byte heap leak per the GHSA trace. Over hundreds or thousands of requests, heap memory is progressively exhausted until the ImageMagick process or its host service crashes or becomes unresponsive, denying service to legitimate users. No public exploit code has been identified; the AC:H and AT:P CVSS 4.0 metrics indicate that reliable triggering requires specific image format or pipeline conditions not trivially met against arbitrary deployments.