ImageMagick EUVD-2026-113190

Exploitation requires that ImageMagick be running with the DNG decoder disabled - a non-default configuration explicitly named by the vendor advisory - and that the attacker get a crafted TIFF image processed by the application. Impact is limited to a process crash (availability only; no data disclosure or modification). The high attack complexity and attack requirements (AC:H/AT:P) in the CVSS 4.0 vector indicate the crash is not trivially or reliably triggerable, and the non-default DNG-disabled requirement further narrows the exposed population. Affected: all versions before 7.1.2-34; fixed in 7.1.2-34.

Signals align on moderate, not urgent, priority. The supplied CVSS 4.0 vector (6.3, medium) shows network vector but AC:H and AT:P (attack complexity high, attack requirements present) and an impact limited to VA:L - availability only, no confidentiality or integrity loss. This is a denial-of-service crash, not code execution, consistent with CWE-674 (uncontrolled recursion / stack exhaustion). The vuln.today decision label is 'this_month', not act_now or emergency. This is NOT in CISA KEV, so there is no confirmed active exploitation, and no EPSS probability was provided in the input, so widespread-exploitation likelihood cannot be quantified from this data. The two references are vendor/analyst advisories (ImageMagick GHSA and VulnCheck), not verified working exploit code, so no public exploit is confirmed. A further limiting factor is the trigger condition stated by the vendor: the flaw occurs specifically when the DNG decoder is disabled, a non-default deployment choice. Net: a genuine but medium DoS issue in very widely deployed software - worth patching on a normal monthly cycle rather than as an emergency, with real-world risk bounded by the non-default configuration requirement and the availability-only impact.

An attacker supplies a crafted TIFF image to a service or workflow that processes images with ImageMagick configured with the DNG decoder disabled; parsing the file triggers a stack overflow that crashes the process, causing denial of service. The exact triggering mechanism beyond 'crafted image' is not detailed in the available sources (CWE-674 implies uncontrolled recursion). No public exploit is identified at time of analysis, and the high attack complexity / attack requirements (AC:H/AT:P) suggest the condition is not trivially reliable.