ImageMagick EUVD-2026-94389

Exploitation requires that the target host is actively running the ImageMagick distributed pixel cache server (the DPC feature in MagickCore/distribute-cache.c), which is NOT part of default ImageMagick usage and must be explicitly deployed for distributed/multi-node image processing. The attacker must also have adjacent-network reachability to the DPC listening socket (AV:A) - remote internet-wide exploitation is not indicated. The limiting factors are therefore: the DPC server must be enabled and network-exposed, and the attacker must be on the same local network segment; no authentication is needed (PR:N) and no user interaction is required (UI:N). Impact is confined to availability of the cache service (A:L), with no data disclosure or modification.

This is a genuine but low-priority issue, consistent across all available signals. The provided CVSS 3.1 vector (AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L, base 4.3 Medium) describes an unauthenticated, low-complexity attack limited to an adjacent network with only a low availability impact and no confidentiality or integrity effect - matching the CWE-400 resource-exhaustion description exactly. No EPSS score was supplied, and there is no CISA KEV listing and no public proof-of-concept in the provided data, so exploitation is neither confirmed nor demonstrated. Crucially, the attack targets ImageMagick's distributed pixel cache (DPC) server, a non-default component that must be explicitly started, so the real-world attack surface is far narrower than the ubiquity of ImageMagick itself would suggest. The AV:A (adjacent) restriction further means an attacker must already be on the same network segment as the DPC server, which is the signal that keeps real risk low despite the unauthenticated, low-complexity nature of the flaw.

An attacker positioned on the same local/adjacent network as a host running the ImageMagick distributed pixel cache server repeatedly opens TCP connections to the DPC listener without completing or closing them, exhausting the server's available connection/worker slots. Legitimate ImageMagick nodes can then no longer reach the cache server, degrading or halting distributed image processing. No public exploit code is identified in the provided data; the fix adds receive timeouts and an authentication read deadline so stalled or slow clients no longer hold connections indefinitely.