ImageMagick EUVD-2026-94391

Exploitation requires the target application to accept and decode an attacker-supplied image through ImageMagick's CALS (Type 1 raster) decoder specifically - the vulnerable code path is coders/cals.c (ReadCALSImage). Limiting factors: the service must be configured to process the CALS format (a niche military/CAD raster format, not among the common JPEG/PNG types), and impact is confined to crashing the single decoding process rather than persistent compromise. No authentication is required per PR:N, and no user interaction per UI:N, so any endpoint that auto-processes uploaded images into which CALS content can be injected is reachable by remote unauthenticated attackers against default configurations, provided CALS decoding is not disabled via policy.xml.

This is a moderate-severity denial-of-service issue, not a high-priority emergency. The input CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L, 5.3) correctly reflects availability-only impact: a crafted CALS image exhausts the call stack and terminates only the processing worker (C:N/I:N - no data exposure or code execution). No EPSS score, no CISA KEV listing, and no public POC were provided, so there is no evidence of active or probable exploitation - exploitation status is 'no public exploit identified at time of analysis.' The signals are internally consistent: a low-impact crash bug in a widely-used library with no exploitation telemetry. One data discrepancy must be flagged: the description attributes the crash to a 'missing recursion-depth check' (consistent with CWE-674), but the actual fix shown in both commit diffs adds a header-field sanity check (rejecting width/height/type/orientation/density of zero or wrong type) rather than a recursion-depth guard - verify the true root cause against the GHSA advisory. Real-world priority is low-to-moderate: patch in routine cycles, prioritizing any internet-facing service that accepts untrusted image uploads.

An attacker uploads or submits a specially crafted CALS raster image to a web application or service that uses ImageMagick to process user-supplied images. When ImageMagick's CALS decoder parses the malformed header, unbounded recursion (or a malformed field passed to downstream processing) exhausts the call stack and crashes the worker process, denying service to legitimate users. No public exploit code was identified, and the attack requires the target to actually invoke the CALS decoder on attacker-controlled input.