ImageMagick EUVD-2026-109413

The target application must accept and decode attacker-supplied MAT-format files through ImageMagick's MAT coder, and the attacker must drive execution down the specific error path that fails to release allocated memory. Realistic impact additionally requires the ability to send crafted files repeatedly to a long-lived process, because each occurrence leaks only a small amount of memory (per the description) - a single file is insufficient. Limiting factors: the MAT decoder must be reachable/enabled, the process must persist across requests to accumulate the leak, and impact is confined to availability (no data exposure or code execution). The precise error-path trigger is not detailed in the available sources.

This is a moderate, availability-only issue rather than a top-tier emergency. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) shows the flaw is reachable remotely without authentication or user interaction and with low attack complexity, but the only impact metric set is VA:L (low availability on the vulnerable system) - confidentiality and integrity are explicitly N, consistent with a CWE-401 memory leak. The vuln.today Decision label is 'this_month', signaling a planned-remediation priority rather than act_now/emergency. No EPSS score, no CISA KEV listing, and no PoC/exploit reference are present in the input, so exploitation is unconfirmed and there is no public exploit identified at time of analysis. The practical risk is bounded by the mechanism: each malicious MAT file leaks only a small amount of memory, so meaningful denial of service requires sustained, repeated submission of crafted files to a process that keeps running (e.g. a long-lived image-processing service). Note one metadata conflict: the input Tags label this 'Information Disclosure', but both the CWE (memory leak / uncontrolled resource consumption) and the CVSS impacts (VC:N, VA:L) indicate an availability/resource-exhaustion issue, not disclosure - the tag appears mislabeled.

An attacker repeatedly submits crafted MAT image files to a service or application that decodes them with ImageMagick's MAT reader, each file taking the specific error path that fails to free allocated memory. Over many requests the small per-file leaks accumulate and gradually exhaust the process's memory, degrading or denying service in long-running workers. No public exploit code is identified in the provided data; exploitation requires only network delivery of malformed MAT files (AV:N/AC:L/PR:N/UI:N).