ImageMagick EUVD-2026-109420

Exploitation requires the ImageMagick -cdl (color decision list) option to actually be invoked on attacker-influenced input; the leak occurs only along that specific code path. The CVSS vector is local (AV:L) with passive user interaction (UI:P), meaning a user or automated workflow must process the crafted input locally rather than it being remotely reachable by default. Limiting factors: the -cdl option must be reachable in the deployment (not all pipelines expose or use it), impact is confined to availability (no data exposure or code execution), and meaningful denial of service requires repeated processing to accumulate the leak rather than a single request. Fixed in 6.9.13-58 (6.x) and 7.1.2-33 (7.x); updating is the stated remediation.

This is a genuinely low-priority availability issue, and the signals are internally consistent rather than conflicting. The supplied CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L) describes a local attack path requiring passive user interaction, with no confidentiality or integrity impact and only low availability impact - a memory leak (CWE-401) in the -cdl option that degrades availability through gradual resource exhaustion, not a code-execution or data-disclosure flaw. The 4.8 base score and the vuln.today 'this_month' decision label agree this is a routine, patch-in-normal-cycle item, not an emergency. No CISA KEV listing is present, so there is no confirmed active exploitation, and no verified working exploit code is supplied - only vendor/VulnCheck advisory references, which are not proof-of-concept exploits. No EPSS score was provided in the input, so exploitation probability cannot be quantified here. The practical risk is bounded: an attacker must get a victim process to repeatedly handle attacker-influenced input through the -cdl option, and even then the worst outcome is memory growth and degraded availability of the affected process/host. Treat as a hygiene patch, not an urgent response.

An attacker submits crafted input that causes an ImageMagick-based workflow to process the -cdl (color decision list) option - for example, an image-conversion pipeline or batch job that passes through attacker-influenced parameters. Each invocation leaks allocated memory that is never freed, so repeated processing steadily exhausts memory and degrades or disrupts availability of the service or host. No public exploit identified at time of analysis; the trigger requires the -cdl code path to be reached and the operation to be repeated many times.