ImageMagick EUVD-2026-94397

Exploitation requires ImageMagick to WRITE output through its PostScript or PDF coders (ps, ps2, ps3, or pdf) while processing an image that carries an attacker-controlled label (e.g., set via -label or embedded caption/metadata); the fix shows these labels were emitted into the output stream without EscapeParenthesis() escaping, allowing PostScript operators to be injected. The injected code only executes when the generated PostScript/PDF is subsequently processed by a PostScript/PDF interpreter such as Ghostscript. Limiting factors: the vector is PR:N (unauthenticated) but UI:R and AC:H - a user or automated pipeline must perform the image-to-PS/PDF conversion with label text present AND the output must be rendered, so default image viewing and non-PostScript conversions are unaffected, and versions at or above 7.1.2-31 / 6.9.13-56 are patched.

This is a medium-severity (CVSS 5.3) code-injection flaw whose real-world priority is moderate rather than urgent. The provided CVSS vector (AV:N/AC:H/PR:N/UI:R) shows a network-reachable, unauthenticated issue but with HIGH attack complexity and required user interaction - exploitation depends on a victim or pipeline actually converting an attacker-supplied image into PostScript/PDF and then having that output rendered, so it is not a point-and-click remote exploit. No EPSS score, CISA KEV listing, or public POC was provided, so there is no public exploit identified at time of analysis and no signal of active or widespread exploitation. There is a notable conflict in the data: the Tags label this 'RCE'/'Code Injection' and the source diffs confirm PostScript operators can be injected (which yields code execution once the output is rendered by an interpreter such as Ghostscript), yet the supplied CVSS vector scores C:H/I:N/A:N - i.e., it does not reflect integrity or availability impact or the downstream execution. This gap should be verified against the vendor advisory; the true impact is likely higher than the provided vector suggests, but the HIGH complexity and interaction requirements keep practical urgency in the medium band.

An attacker crafts an image whose label/metadata contains unescaped parenthesis and PostScript operators. When a victim or automated pipeline uses ImageMagick to convert that image into PostScript or PDF (via the ps/ps2/ps3/pdf coders) and the resulting file is later rendered by a PostScript interpreter such as Ghostscript, the injected operators break out of the text string and execute. No public exploit code was identified at time of analysis, but the fix diffs clearly reveal the injection point.