ImageMagick CVE-2026-56372

Exploitation requires that a user or automated process invoke ImageMagick's magnify operation on an attacker-controlled image file containing an unrecognized magnify:method value - this is the specific triggering condition per the CVE description. The CVSS 4.0 vector confirms: local attack vector (AV:L), meaning the crafted file must reach and be processed on the target host; user interaction required (UI:P), meaning a human user or automated pipeline action must initiate processing of the file; no privileges required (PR:N), meaning the attacker does not need an account on the system, only the ability to place or deliver the crafted image. Exploitation is limited by: (1) the local processing requirement - remote network exploitation is not possible without a delivery vector such as a file upload endpoint; (2) the need for the magnify operation specifically to be invoked, which depends on how the application uses ImageMagick; and (3) the low impact class - memory disclosure is partial and limited to adjacent heap contents, and the DoS is process-level rather than system-level.

The CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L) scores 4.8 Medium, reflecting a local attack vector with required user interaction and only low availability impact on the vulnerable system. The local attack vector (AV:L) is the primary risk limiter: an attacker cannot directly exploit this over a network; a user or service must locally process the crafted image. However, in server-side deployments where ImageMagick automatically processes user-uploaded images, the effective attack surface is broader than AV:L alone implies, since the 'user interaction' may be fulfilled by an automated pipeline rather than a human. No EPSS score was provided in the input data, so exploitation probability cannot be numerically quantified. The vulnerability is not in CISA KEV and no public exploit code has been identified, reinforcing its low-urgency classification. The VA:N/VC:N assignment in the provided vector conflicts mildly with the description's mention of 'potentially exposing sensitive information'; an independent assessment places C:L as more appropriate. Overall, this represents a genuine but low-priority finding - upgrade is warranted, but emergency patching is not justified by the available signals.

An attacker crafts a malicious image file embedding an unrecognized magnify:method value in its metadata or processing directives, then uploads it to a web application or shares it with a user whose workflow invokes ImageMagick (e.g., a CMS thumbnail generator, a document converter, or a command-line convert invocation). When ImageMagick's magnify operation processes the file and encounters the unrecognized method value, it performs a heap out-of-bounds read, potentially leaking adjacent heap contents to the attacker (if output is reflected) or crashing the processing process. No proof-of-concept exploit has been identified at time of analysis, but the trigger condition is straightforward to craft given knowledge of ImageMagick's image processing directive format.