ImageMagick EUVD-2026-94393

Exploitation requires that the target run ImageMagick's distributed pixel cache (DPC) server - an opt-in clustering feature that is NOT enabled in default ImageMagick installations and is not reachable through ordinary image-conversion or CMS upload paths. The attacker must be able to reach the DPC listener as a connecting client (CVSS AV:A indicates an adjacent/trusted-network position rather than arbitrary Internet access), then send crafted pixel data whose metacontent_extent causes the packet_size integer calculation to overflow, producing a heap overwrite. No authentication is needed (PR:N) and no user interaction is required (UI:N). Limiting factors: the non-default DPC deployment mode, the adjacent-network reachability requirement, and the impact being confined to a server crash (availability only; no code execution or data disclosure indicated).

This is a moderate, availability-only issue, not a top-tier priority. The CVSS 3.1 base score of 5.3 (AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H) reflects a crash-only outcome: no confidentiality or integrity impact, only a denial of service against the distributed pixel cache (DPC) server. No EPSS score was supplied, the CVE is not listed in CISA KEV, and no public exploit was provided, so exploitation status is 'no public exploit identified at time of analysis.' The single meaningful risk amplifier is PR:N (the connecting client need not authenticate), but this is tempered heavily by the fact that the DPC server is a non-default, opt-in clustering feature that must be explicitly started and is normally confined to a trusted adjacent network (AV:A). One signal to verify: the vendor-assigned AC:H implies some non-trivial condition to trigger the integer-size miscalculation, yet the source-code fix (a simple HeapOverflowCheckAdd guard on packet_size) and the description ('send crafted pixel data') suggest a straightforward crafted-input trigger rather than a race - AC may realistically be Low, with the true barrier being the non-default DPC deployment rather than attack complexity. Net: patch in environments running the distributed pixel cache, but this does not warrant emergency prioritization for the vast majority of ImageMagick deployments that never enable DPC.

An organization runs an ImageMagick distributed pixel cache server to share pixel caches across a processing cluster. An attacker with access to that adjacent/trusted network connects to the DPC port as a client and sends crafted pixel data whose metacontent extent forces an integer-size calculation error, producing a heap buffer overwrite that crashes the server and disrupts dependent image-processing workloads. No public exploit code was provided in the source data.