ImageMagick EUVD-2026-113191

Exploitation requires that a user process an attacker-supplied crafted image using ImageMagick's -morph option on an affected version (before 7.1.2-34). The concrete prerequisite is invocation of the -morph operation on untrusted image input; environments that never use -morph on attacker-controlled images are not exposed. Limiting factors: the attack vector is local (AV:L) and requires user/victim interaction to run the operation (UI:P), and the impact is confined to availability (a crash/denial of service) with no confidentiality or integrity impact per the CVSS vector and description. The only complete remediation stated by the vendor is updating to 7.1.2-34.

This is a genuinely low-to-moderate priority issue, and the signals are internally consistent rather than conflicting. The CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L) scores 4.8 (medium) and describes a local, low-complexity flaw whose only impact is availability (VC:N/VI:N/VA:L) - i.e. a crash, not information disclosure or code execution. The description corroborates this: crafted images 'corrupt heap memory and crash the application,' with no claim of controlled code execution despite the CWE-122 heap-overflow class. The vuln.today decision label is 'this_month,' not 'act_now' or 'emergency,' so remediation should be scheduled this month rather than treated as an incident. No EPSS score, no CISA KEV listing, and no proof-of-concept or exploit reference are present in the input - only vendor (GHSA) and reporter (VulnCheck) advisories. The absence of EPSS/KEV/POC is not evidence of safety but does align with the modest technical impact: this reads as a reliability/denial-of-service defect in a specific operation, not a widely weaponized RCE. The practical limiter is that exploitation requires a user to run ImageMagick with the -morph option against an attacker-supplied image (UI:P, AV:L), narrowing real-world exposure to pipelines that actually invoke -morph on untrusted input.

An attacker submits a specially crafted image to a workflow or service that processes it with ImageMagick's -morph option; when the victim runs that operation, the malformed image triggers a heap buffer over-write that corrupts memory and crashes the application. Because the attack vector is local and requires the victim to invoke -morph (UI:P, AV:L), the realistic effect is denial of service of the image-processing task rather than confirmed remote code execution. No public exploit or PoC is identified at time of analysis.