ImageMagick EUVD-2026-94409

Exploitation requires that the target application pass attacker-influenced image data (e.g. user-uploaded files or externally fetched images) through a vulnerable ImageMagick version (before 7.1.2-30 / 6.9.13-55) in a code path that parses embedded XMP profiles - i.e. any normal image-decoding or metadata-handling operation. No authentication, user interaction, or non-default configuration is needed on ImageMagick's side (PR:N/UI:N). The key limiting factor is impact scope: the flaw only terminates the single image-processing process/worker (A:L, S:U), causing no data disclosure, no corruption, and no code execution, so realistic damage is confined to availability of the affected processing task or service.

This is a limited-impact denial-of-service issue, not a high-priority emergency. The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L, base 5.3 Medium) indicates a remotely reachable, low-complexity, unauthenticated trigger, but with NO confidentiality or integrity impact and only LOW availability impact - consistent with the description, where a crafted XMP profile hits a recursion limit that was wrongly treated as a fatal condition, terminating only the image-processing process rather than crashing a whole host or enabling code execution. No EPSS score, no CISA KEV listing, and no public POC were provided in the input, so there is no signal of active or widespread exploitation; absence of these is not evidence of safety but does argue against urgent prioritization. No SSVC decision data was supplied. The source-code evidence (replacing ThrowFatalException with a NULL return in DestroyXMLTree_) confirms the root cause and the fix, strengthening confidence that this is genuinely a crash/abort bug, not a memory-corruption primitive. Net: a real but low-severity availability bug worth patching in image-upload pipelines, not a drop-everything priority.

An attacker uploads or submits an image file containing a maliciously crafted XMP metadata profile with deeply nested structure to a web service or pipeline that uses a vulnerable ImageMagick version to process uploads. When ImageMagick parses the XMP, it hits the internal recursion limit, which is raised as a fatal exception and terminates the processing worker, denying service for that request (and potentially repeatedly). No public exploit code was identified in the provided data.