ImageMagick EUVD-2026-94390

Exploitation requires the ability to make a local, crafted call reaching ImageMagick's GetVirtualPixels / SetPixelCacheNexusPixels pixel-cache code path (MagickCore/cache.c, magick/cache.c) with attacker-controlled width/height (and channel/metacontent) values chosen so the number_pixels and length multiplications overflow MagickSizeType before the fix's CacheOverflowSanityCheckGetSize bounds checks existed. Limiting factors: the vector is local (AV:L), not network-reachable; attack complexity is high (AC:H) because a precise integer-overflow condition must be induced; impact is confined to a process crash (C:N/I:N/A:H), so there is no confidentiality or integrity loss and no demonstrated code execution; and the flaw is fully remediated in ImageMagick 6.9.13-56 and 7.1.2-31.

This is a moderate-severity, low-urgency issue despite the memory-corruption language in the description. The CVSS 3.1 vector (AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H, base 5.1) is internally consistent with the description: exploitation requires a 'crafted local call' (AV:L), depends on inducing an integer-overflow condition with specific image dimensions (AC:H), and the only impact is availability (A:H) - the process crashes. Critically, although the text says the flaw can 'write beyond a heap buffer,' the vector scores C:N/I:N, indicating the realistic outcome is a denial-of-service crash rather than information disclosure or code execution; the 'Denial Of Service' tag reinforces this. No EPSS score, CISA KEV listing, or public POC was provided in the intelligence, so there is no evidence of active exploitation or weaponization - no public exploit identified at time of analysis. The local-only attack surface and high attack complexity substantially cap real-world risk: an attacker must already be able to invoke the GetVirtualPixels API path (typically via locally processed, attacker-influenced image parameters) and trigger a precise overflow. Net assessment: patch as routine maintenance given ImageMagick's broad footprint, but this is not a drop-everything priority - it is a high-prevalence product with a low-impact (DoS), local, high-complexity bug.

An attacker able to feed input to a local process that uses ImageMagick's GetVirtualPixels API supplies crafted image dimensions that trigger an integer calculation error in SetPixelCacheNexusPixels, causing a write beyond a heap buffer. The result is a crash of the server/worker process (denial of service) rather than data theft or code execution. No public exploit identified at time of analysis, and the local attack vector plus high complexity limit practical abuse.