ImageMagick EUVD-2026-109404

Exploitation requires that ImageMagick be configured with a security policy that imposes a list-length limit on scene selection in the PS, PDF or XPS decoders - the vulnerability is specifically a bypass of that limit, so without such a policy there is no limit being circumvented. The attacker must be able to supply the specific scene-selection argument to a PS/PDF/XPS input that ImageMagick processes. Limiting factors: the CVSS vector is local with low privileges required (AV:L/PR:L), impact is confined to availability (resource exhaustion/DoS) with no code execution or data exposure, and affected versions are those before 6.9.13-58 (6.x) and before 7.1.2-33 (7.x). The exact argument that triggers the bypass is not detailed in the available sources.

This is a low-to-moderate priority issue, not an emergency. The CVSS 4.0 base score is 4.8 (medium) with a vector (AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L) that limits impact to availability only (VA:L) via a local vector requiring low privileges - there is no confidentiality or integrity impact. The vuln.today decision label is 'this_month', consistent with a non-urgent but patch-worthy flaw. No CISA KEV listing is present (no confirmed active exploitation), no EPSS probability was supplied, and the references are vendor/coordinator advisories (ImageMagick GHSA and VulnCheck) rather than published exploit code, so there is no public exploit identified at time of analysis. The signals are internally consistent - a resource-exhaustion policy bypass (CWE-770) that degrades availability rather than enabling code execution or data theft. One caveat: the practical reachability of AV:L/PR:L depends heavily on how ImageMagick is exposed (e.g. a web service that forwards user-supplied scene arguments could effectively lower the privilege barrier versus the local framing), so operators should assess their own deployment rather than rely on the base vector alone.

An attacker able to submit a PS, PDF or XPS file (or its scene-selection argument) to a system using ImageMagick supplies a specific crafted argument that circumvents the security policy's list-length limit on scene selection. ImageMagick then processes far more scenes than the policy intended, consuming excess memory and CPU and degrading or exhausting resources on the host. No public exploit code was identified in the provided sources, and the exact triggering argument is not described in the available advisories.