ImageMagick EUVD-2026-94399

Exploitation requires the target to decode/render an image containing attacker-controlled MVG (Magick Vector Graphics) content through ImageMagick's RenderMVGContent path (MagickCore/draw.c), on versions prior to 7.1.2-31 (v7) or 6.9.13-56 (v6). The practical prerequisite is an application or workflow that automatically processes untrusted images (e.g., an upload handler, thumbnailer, or conversion service). Limiting factors: the CVSS HIGH attack complexity (AC:H) indicates the invalid free depends on specific primitive/coordinate conditions rather than firing deterministically; impact is confined to a process crash with no confidentiality or integrity effect, so there is no code execution or data exposure. If the deployment never passes untrusted or MVG-bearing images to ImageMagick, the issue is not reachable.

This is a moderate-severity denial-of-service issue, not a code-execution priority. The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H, base 5.9) shows an availability-only impact with no confidentiality or integrity loss, reachable without privileges or user interaction but gated by HIGH attack complexity - consistent with CWE-590 (free of memory not on the heap), where triggering the invalid free typically depends on specific heap/parse state rather than a deterministic path. No EPSS score was provided, the CVE is NOT in CISA KEV, and no public exploit or POC was supplied; a patch commit diff is available but that demonstrates the fix, not a weaponized exploit. The AV:N rating is reasonable only in the common deployment where an application automatically feeds attacker-supplied images into ImageMagick; in isolation ImageMagick is a library/CLI, so the 'network' vector really means 'attacker controls the processed image.' Net assessment: a real but bounded risk - worst case is a crashed image-processing worker/request, with AC:H limiting reliable mass exploitation. Treat as routine-to-elevated patch hygiene, not an emergency, absent evidence of active exploitation.

An attacker uploads or submits a crafted image containing malicious MVG (Magick Vector Graphics) content to a web service or pipeline that processes images with ImageMagick. When the MVG decoder in RenderMVGContent parses the primitive coordinates, a miscalculated extent leads to an invalid memory free, crashing the worker process. No public exploit code is identified at time of analysis, and the HIGH attack complexity means reliably triggering the fault may require tailoring the input to the target build.