ImageMagick EUVD-2026-94392

The target application must pass attacker-controlled MVG (Magick Vector Graphics) content to ImageMagick's drawing/rendering path (RenderMVGContent), e.g. any upload or conversion pipeline that renders MVG or images that invoke MVG primitives. The specific trigger is MVG macro expansion with no upper bound in versions prior to 7.1.2-31 (and 6.9.13-56). Per the CVSS vector (PR:N/UI:N), no authentication or user interaction is required, and no non-default configuration is implied by the description. The principal limiting factor is reachability: exploitation depends on the deployment actually accepting and rendering untrusted MVG-capable input; environments that restrict ImageMagick's enabled coders/policy (policy.xml) to disallow MVG, or that never process untrusted images, are not exposed. Impact is bounded to availability degradation (A:L), not data exposure or code execution.

This is a genuine but moderate-priority issue, not a top-tier emergency. The vendor CVSS of 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) correctly caps impact at availability-only with low magnitude: there is no confidentiality or integrity impact and no code execution - only CPU/time exhaustion from an unbounded MVG macro-expansion loop (CWE-400). The network vector and no-privilege, no-interaction metrics are realistic because ImageMagick is typically invoked server-side on attacker-supplied images, so a remote unauthenticated actor can usually reach the decoder. No EPSS score, KEV entry, or POC flag was supplied in the input: there is no public exploit identified at time of analysis and no evidence of active exploitation. The only exploitation-relevant artifact provided is the upstream patch commit (a fix, not weaponized exploit code). The A:L rating (degradation via an 'excessively long-running operation') rather than A:H (hard crash) suggests the practical effect is resource starvation/latency rather than a clean process kill, which is consistent with the macro-expansion limit the patch introduces. Net: prioritize for patching anywhere ImageMagick ingests untrusted images, but it ranks below any RCE or memory-corruption ImageMagick bug.

An attacker uploads a crafted MVG (Magick Vector Graphics) file - or an image that triggers MVG rendering - to a web service that uses ImageMagick for thumbnailing or conversion. The MVG content abuses macro expansion so the RenderMVGContent routine performs an enormous number of expansions, consuming CPU and stalling the worker. With no public POC noted, exploitation would require crafting such input, but the low attack complexity (AC:L) and no authentication requirement (PR:N) make this straightforward for a motivated actor against any default MVG-processing pipeline.