ImageMagick EUVD-2026-109412

Exploitation requires that the target application actually uses ImageMagick to ENCODE/convert an attacker-supplied image to the JNG output format - the leak is specific to the JNG encoder, so pipelines that never produce JNG output are not affected. The CVSS vector is PR:N/UI:N, so no authentication or user interaction is required where such an encoding path is exposed (e.g. an image-upload or transcoding service). Limiting factors: impact is availability-only and limited (VA:L), a single request leaks only a bounded amount of memory so sustained repeated submissions are needed for real resource exhaustion, and the AC:H/AT:P metrics indicate the attack is not trivially repeatable - though the sources do not describe why. Affected versions are ImageMagick before 6.9.13-58 (6.x) and 7.x before 7.1.2-33; updating is the fix provided by the vendor.

This is a moderate, low-urgency issue rather than a top priority. The CVSS 4.0 vector (AV:N/AC:H/AT:P/PR:N/UI:N) scores 6.3 but the only impact is VA:L - a limited availability effect with no confidentiality or integrity impact (VC:N/VI:N), consistent with CWE-401 (memory leak). The vuln.today decision label is 'this_month', not act_now or emergency, matching the limited-DoS characterization. No EPSS score was provided, there is no CISA KEV listing, and the two references are vendor/VulnCheck advisories rather than working exploit code, so exploitation probability signals are absent-to-low. The AC:H and AT:P metrics indicate the attack is not trivially repeatable or carries an attack requirement, but the available sources do not describe the trigger mechanism, so the reason for that complexity is not stated. The practical risk is bounded: a single crafted image leaks memory, so a meaningful denial of service requires sustained, repeated processing of malicious inputs. Net: a real but low-severity hardening fix, appropriate to schedule within normal patch cycles rather than treat as an incident.

An attacker submits a crafted image to a service that uses ImageMagick to encode or convert images into JNG format (for example an upload/transcoding endpoint). Each conversion leaks allocated memory that is never released; by repeatedly submitting such images the attacker gradually exhausts memory and degrades or disrupts the service. No public exploit code was identified, and the CVSS AC:H/AT:P metrics suggest exploitation is not perfectly reliable.