ImageMagick EUVD-2026-72379

Exploitation requires that an attacker can supply an MSL-format image to a running ImageMagick instance - most commonly a web application or API accepting untrusted file uploads without format filtering. The CVSS 4.0 AC:H and AT:P metrics indicate specific preconditions beyond mere network access: the crafted MSL payload must be structured to reliably trigger the faulty allocation path, and meaningful DoS likely requires sustained or repeated submissions rather than a single request. Impact is strictly limited to availability (DoS via memory exhaustion) with no confidentiality or integrity exposure. Services that restrict accepted MIME types or image formats at the application layer before invoking ImageMagick, apply upload rate limits, or run ImageMagick under memory-constrained process groups are substantially protected.

The CVSS 4.0 score of 6.3 (Medium) accurately captures the bounded scope: only availability of the vulnerable system is affected (VA:L), with no confidentiality or integrity compromise. The AC:H and AT:P metrics are significant - reliable exploitation is not trivially automated and depends on specific preconditions, likely the shape of the MSL payload or processing context. No EPSS score, KEV listing, or public proof-of-concept was provided in the source data; exploitation remains unconfirmed beyond the vendor's advisory. Real-world risk is elevated for services that accept untrusted file uploads and process MSL-format input without format filtering or memory limits (image conversion APIs, CMS platforms using ImageMagick). For services with upload rate limiting, memory cgroups, or format allowlists, the risk is substantially mitigated. This is not a high-urgency priority for most deployments, but patching is low-cost and should be applied during the next maintenance cycle.

An attacker submits a stream of specially crafted MSL image files to a web application or API endpoint that passes uploads directly to ImageMagick for processing. Each request causes a small but persistent heap leak in the MSL decoder; across hundreds or thousands of requests the process's resident memory grows until the hosting process is OOM-killed or the system begins swapping, degrading service for legitimate users. No public proof-of-concept has been identified, and the AC:H and AT:P CVSS metrics indicate reliable exploitation requires specific payload conditions rather than a trivial generic MSL file.