ImageMagick EUVD-2026-109403

Exploitation requires that ImageMagick process an attacker-supplied crafted image specifically through the minimum-bounding-box printing/output code path (e.g., an identify/convert operation that prints the minimum bounding box). The CVSS vector's UI:P indicates passive user interaction - a victim or automated service must feed the malicious image into that operation; it is not reachable without processing attacker-controlled input. Limiting factors: the attack vector is local (AV:L), impact is limited to a read-only over-read yielding a crash or disclosure of adjacent heap bytes, and only ImageMagick versions before 7.1.2-33 are affected (fixed in 7.1.2-33). Authentication is not required (PR:N), but the dependence on the minimum-bounding-box operation and on supplying a crafted image constrains realistic exploitation to environments that expose that processing path to untrusted images.

This is a genuine but low-to-moderate priority issue rather than a top-tier emergency. The assessed CVSS 4.0 base score is 4.8 (Medium), driven by a local attack vector (AV:L), low attack complexity (AC:L), no required privileges (PR:N), but mandatory passive user interaction (UI:P) and limited impact (confidentiality-low via heap memory disclosure plus crash/denial-of-service). No EPSS score is provided in the input, so exploitation probability cannot be quantified. The vulnerability is NOT in CISA KEV and shows no public exploit code, so this is 'no public exploit identified at time of analysis.' The vuln.today decision label is 'this_month,' consistent with a patch-on-normal-cadence item rather than act_now/emergency. The limiting factors are significant: exploitation requires the victim (or a service) to process an attacker-supplied crafted image specifically through minimum-bounding-box output, and the primary impact is a read-only over-read (crash or adjacent-heap disclosure) with no integrity or confirmed code-execution impact. The main amplifier of risk is ImageMagick's enormous deployment footprint in automated server-side image pipelines, where attacker-controlled images are routinely processed. Note: the input CVSS 4.0 vector lists VA:N (no availability impact), yet the description explicitly states the over-read can cause crashes - this is an internal inconsistency; the assessment below corrects it to VA:L/A:L.

An attacker crafts a malformed image file and submits it to a system that runs ImageMagick with minimum-bounding-box output (for example an upload handler or batch tool invoking identify/convert with a bounding-box print operation). When ImageMagick prints the minimum-bounding-box for the crafted image, it reads beyond the allocated heap buffer, crashing the process or leaking fragments of adjacent heap memory into the output. No public exploit code is identified at time of analysis; the trigger is a crafted image processed through the minimum-bounding-box code path.