ImageMagick EUVD-2026-94380

Exploitation requires that the target application or service invoke ImageMagick to read/decode image data that is bzip2-compressed, and that the attacker can supply a crafted image whose bzip2 stream is truncated or malformed so that the decompressor never signals end-of-file - triggering the infinite loop in ReadBlob/EOFBlob (MagickCore/blob.c and magick/blob.c). No authentication is required (CVSS PR:N) and no user interaction is needed (UI:N), making it exploitable against any automated image-processing pipeline that accepts untrusted input. Limiting factors: the attack complexity is high (AC:H) because the malformed bzip2 stream must be deliberately constructed to hit the missing-EOF path, the deployment must actually process bzip2-compressed image content through a vulnerable version (before 7.1.2-32 / 6.9.13-57), and impact is confined to availability (resource exhaustion) with no data confidentiality or integrity consequence.

This is a genuine but moderate-priority issue, best characterized as a high-CVSS-component (availability) flaw with limited real-world urgency. The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H = 5.9 MEDIUM) shows an unauthenticated, network-reachable denial-of-service with only availability impact (C:N/I:N) and elevated attack complexity (AC:H), consistent with CWE-400 resource exhaustion via an infinite loop on malformed bzip2-compressed image data. No EPSS score, KEV listing, or POC was provided in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation - this contrasts with the network-reachable vector, meaning exposure potential exists but observed exploitation does not. The AC:H rating appropriately tempers the AV:N/PR:N exposure: an attacker must craft a specifically truncated bzip2 stream to trigger the missing end-of-file condition. No SSVC decision data was supplied. Net assessment: a worth-patching availability bug for services that auto-process untrusted images through ImageMagick, but not an emergency given it cannot compromise confidentiality or integrity and has no confirmed exploitation.

An attacker uploads or submits a specially crafted image containing a truncated/malformed bzip2-compressed data stream to a web application or service that uses ImageMagick for server-side image processing. When ImageMagick reads the data, the missing end-of-file check causes ReadBlob to loop indefinitely, pinning CPU and exhausting processing resources, degrading or hanging the service. No public exploit code was identified in the provided data, and the high attack complexity means the malicious bzip2 stream must be deliberately constructed.