ImageMagick EUVD-2026-82907

Exploitation requires the target to process a specially crafted or sufficiently large PNM (Netpbm) image through ImageMagick's PNM coder, AND for ImageMagick to hit its configured memory/resource limit at the specific allocation point where the failed allocation is not checked - this precise resource-exhaustion timing is what the CVSS AC:H and AT:P reflect. Limiting factors: the impact is confined to a denial of service (single-process crash, restartable) with no data exposure or code execution; exploitation depends on the application actually accepting PNM input and on the deployed ImageMagick resource-limit configuration. The vendor marks PR:L, but whether authentication is truly required depends on the embedding application's upload path.

This is a low-priority, low-real-risk issue. All signals converge: the vendor CVSS 4.0 base score is only 2.3, the sole impact is availability (VA:L) via an application crash - no confidentiality or integrity impact (VC:N/VI:N) - and the CWE-476 NULL pointer dereference produces a bounded denial of service, not code execution. Attack complexity is high (AC:H) with an attack requirement (AT:P) because the crash only triggers when a memory/resource limit is reached at a specific point during PNM processing, i.e. the attacker must reliably drive ImageMagick to its resource ceiling at the exact vulnerable allocation. There is no CISA KEV listing, no EPSS score supplied, and no public exploit code referenced, so exploitation status is 'no public exploit identified at time of analysis.' One conflict worth noting: the vendor vector uses PR:L (authenticated), but ImageMagick is most often invoked on untrusted images submitted to a service without authentication, so PR:N may be more realistic in many deployments - verify against the specific integration. Even under the worst case the outcome is a restartable process crash, so this ranks well below any RCE or data-disclosure flaw despite ImageMagick's broad footprint.

An attacker submits a specially crafted or deliberately oversized PNM image to a web application or service that processes uploads through ImageMagick's PNM coder. When ImageMagick hits its configured memory/resource limit at the vulnerable allocation point, the unchecked failed allocation is dereferenced as NULL and the worker process crashes, denying image-processing service. No public exploit code is referenced, and the high attack complexity (AC:H/AT:P) means the attacker must reliably force the resource-limit condition.