ImageMagick EUVD-2026-109405

Exploitation requires ImageMagick to read a crafted MVG (Magick Vector Graphics) file via the MVG decoder, and the advisory specifies this occurs only on 'certain paths' reached 'when reading the file with specific arguments' - meaning the triggering command-line arguments or API invocation parameters are a precise prerequisite, though the exact arguments are not enumerated in the available sources. Limiting factors: the formal vector is local (AV:L) and requires user interaction (UI:P), so the attacker must induce a victim or an automated pipeline to process the malicious file; affected versions are ImageMagick before 6.9.13-58 (6.x) and 7.0.0-0 up to before 7.1.2-33 (7.x); impact is limited to a process crash (availability only, no code execution, data disclosure, or integrity loss per the CVSS and advisory).

This is a moderate-severity, availability-only denial of service, and the combined signals argue against emergency prioritization. The supplied CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L) describes a local attack vector requiring passive user interaction, with no confidentiality or integrity impact and only low availability impact (a process crash), consistent with the CWE-674 uncontrolled-recursion stack-overflow mechanism described. There is no public exploit identified at time of analysis - the two references are a GitHub Security Advisory and a VulnCheck advisory, not verified working exploit code. The CVE is not listed in CISA KEV, and no EPSS score was provided in the input, so exploitation probability cannot be quantified here. The vuln.today decision label is 'this_month' (not act_now or emergency), which aligns with a patchable, non-exploited DoS. One point to verify: the CVSS uses AV:L (local), yet ImageMagick is frequently invoked server-side on attacker-supplied files, so in such pipelines the practical exposure can resemble a remote file-processing risk even though the formal vector is local - assess against your own deployment (whether untrusted MVG input reaches ImageMagick with the relevant arguments).

An attacker crafts a malicious MVG file containing deeply nested or recursive drawing constructs and gets a victim or a server-side pipeline to process it with ImageMagick using specific arguments. The uncontrolled recursion in the MVG decoder exhausts the stack, crashing the process and denying service. No public exploit code is identified at time of analysis, and the local vector plus required user interaction (UI:P) mean the attacker must get the target to open or process the crafted file.