ImageMagick EUVD-2026-109402

Exploitation requires that the target application decode attacker-supplied Ultra HDR (UHDR) images through ImageMagick, and that ImageMagick be relied upon to enforce width/height resource limits via its security policy - those are precisely the limits that are bypassed because the extent check in the UHDR decoder runs after the decode rather than before. The practical limiting factors are: impact is confined to resource consumption / denial of service (no confidentiality, integrity, or code execution per VC:N/VI:N/VA:L); the application must accept and process UHDR-format input from untrusted sources; and the affected version must be prior to 7.1.2-33. No special authentication is needed (PR:N) and no user interaction is required (UI:N), so any endpoint that automatically processes uploaded UHDR images is reachable.

This is a genuine but bounded issue, best described as a medium-severity denial-of-service rather than a top-priority emergency. The input CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) and score of 6.9 indicate a remotely reachable, low-complexity, unauthenticated condition whose only impact is limited availability loss (VA:L; VC:N/VI:N - no confidentiality, integrity, or code-execution impact), consistent with CWE-400/CWE-770 resource exhaustion. The vuln.today decision label is 'this_month', i.e. a scheduled-patch priority, not act_now or emergency. No EPSS score, no CISA KEV listing, and no public PoC or exploit reference are present in the supplied data, so there is no signal of active or probable near-term exploitation. The signals are therefore internally consistent: a network-reachable but impact-limited (availability-only) flaw whose practical risk depends heavily on whether an application actually feeds attacker-supplied UHDR images to ImageMagick. Note the ImageMagick advisory itself explicitly justifies Medium rather than High severity precisely because the only consequence is that configured width/height policy limits are bypassed during decode. EPSS is missing from the input and cannot be assessed; its absence is not itself a risk indicator.

An attacker submits a specially crafted Ultra HDR (UHDR) image with grossly oversized declared dimensions to an application (for example, an image-upload or thumbnail service) that passes untrusted images to ImageMagick. Because the width/height extent checks run only after the UHDR decode completes rather than before, the configured resource-limit policy is bypassed and the oversized image is fully decoded first, consuming excessive memory and CPU. No public exploit was identified in the supplied data, and authentication requirements map to PR:N, so the action is reachable by unauthenticated remote attackers against any endpoint that decodes UHDR input.