ImageMagick EUVD-2026-94382

Exploitation requires (1) a 32-bit ImageMagick build - the integer-conversion error does not manifest on standard 64-bit builds, which eliminates most modern deployments; (2) the target must decode a PSD file whose image resource block contains a crafted offset value that triggers the conversion error in ParseImageResourceBlocks; and (3) an application path that feeds attacker-controlled images to ImageMagick (e.g., upload-and-convert endpoints). No authentication is indicated by the vector (PR:N) and no user interaction is needed (UI:N) in automated pipelines. The dominant limiting factor is the 32-bit precondition; impact is confined to availability (process hang/CPU exhaustion) with no code execution or data exposure.

This is a moderate-priority, availability-only denial-of-service issue rather than a high-impact flaw. The provided CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H = 5.9 Medium) shows no confidentiality or integrity impact - the worst outcome is an infinite loop hanging the process. AC:H and the description's explicit '32-bit builds' qualifier materially constrain exploitability: modern server and desktop ImageMagick deployments are overwhelmingly 64-bit, so the vulnerable population is a subset of all installs. No EPSS score, KEV listing, POC, or SSVC data were supplied in the input; therefore there is no public exploit identified at time of analysis and no evidence of active exploitation. The one strong corroborating signal is high-quality source evidence: vendor security advisory (GHSA-g6p6-3ggg-3w7j) plus the actual fix commits for both the 7.x and 6.x branches, confirming the root cause and the patch. Net: a real but low-urgency bug - patch during normal maintenance, prioritizing 32-bit image-processing services; it does not warrant emergency response.

An attacker uploads a maliciously crafted PSD file to a web service or pipeline that uses a 32-bit ImageMagick build to process user-supplied images. When the PSD decoder parses the image resource blocks, an integer-conversion error on a crafted offset value sends the parser into an infinite loop, pinning CPU and hanging the worker so that image conversion stalls indefinitely. No public exploit code is identified at time of analysis, and the AC:H rating reflects that the crafted offset plus a 32-bit target are both required.