ImageMagick EUVD-2026-109408

Exploitation requires that an attacker-supplied DJVU image be processed by ImageMagick AND that a memory allocation within the DJVU decoder fail during that processing - the crash occurs specifically 'under conditions where the allocation fails,' so the trigger depends on an allocation-failure condition the attacker does not directly control (reflected as AC:H/AT:P). Limiting factors: the target must actually invoke the DJVU decoding path on untrusted input, affected versions are ImageMagick <6.9.13-58 (6.x) and <7.1.2-33 (7.x), and impact is confined to availability (a process crash) with no code execution or data exposure. No authentication is required per the vector (PR:N), and no user interaction is needed (UI:N).

This is a genuine but modest-priority issue, not a high-severity emergency. The CVSS 4.0 vector (AV:N/AC:H/AT:P/PR:N/UI:N) and the 6.3 (Medium) score are internally consistent with the description: the only impact is availability (VA:L) - a single-process crash - with no confidentiality or integrity effect (VC:N/VI:N). The AC:H and AT:P metrics align with the described trigger: the null pointer dereference occurs only 'under conditions where the allocation fails,' i.e. the attacker does not directly control the trigger and must rely on a memory-allocation failure, which is an attacker-uncontrolled condition the evidence explicitly states. No EPSS score was provided, the CVE is not listed in CISA KEV, and no confirmed working exploit code is present in the input (only advisory references from VulnCheck and the ImageMagick GHSA). The vendor priority label is 'this_month,' consistent with a patch-when-convenient DoS rather than an act-now flaw. Net: a real, patch-this-cycle availability bug whose practical exploitability is limited by its dependence on allocation failure, not a widespread-exploitation threat.

An attacker submits a crafted DJVU image to a service that decodes untrusted images with ImageMagick (for example an upload/thumbnailing pipeline). If the image is processed at a moment when a memory allocation in the DJVU decoder fails, the unchecked null pointer is dereferenced and the processing worker crashes, denying service. No public working exploit is identified in the available sources, and the crash depends on an allocation failure the attacker does not directly control (AC:H/AT:P).