ImageMagick EUVD-2026-94410

Exploitation requires two concrete prerequisites drawn from the description: (1) the target must be running an ImageMagick build compiled WITHOUT Cairo support, which forces use of the vulnerable rsvg_handle_free code path in coders/svg.c; and (2) a specially crafted RSVG/SVG image must be processed that reaches an internal resource limit, which triggers the double-free followed by use-after-free. Limiting factors that reduce realistic risk: the non-Cairo build is not the configuration used by many mainstream distribution packages (so a large share of deployments are not on the vulnerable path), the resource limit must actually be hit, attack complexity is high (AC:H), and the only outcome is a process crash - there is no authentication requirement (PR:N) and no user interaction (UI:N), but also no confidentiality or integrity impact.

This is a medium-severity denial-of-service issue (CVSS 5.9) with an availability-only impact - the CVSS vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H confirms no confidentiality or integrity loss (C:N/I:N) and only a process crash (A:H). The vector shows network reach (AV:N) and no authentication (PR:N/UI:N), which raises exposure, but high attack complexity (AC:H) materially lowers real-world risk because exploitation requires a specific non-default build condition (ImageMagick compiled WITHOUT Cairo support) plus the crafted RSVG image reaching a resource limit. Exploitation status is 'no public exploit identified at time of analysis' - this CVE is NOT in CISA KEV and no public POC was supplied. No EPSS score was provided in the input, so probabilistic exploitation likelihood cannot be quantified; this is a MISSING signal and should not be assumed low or high. No SSVC decision data was provided. Net: this is a real but low-urgency bug - a CWE-415 double-free leading to use-after-free that crashes the process, not code execution - and should be patched on normal cadence rather than treated as an emergency, especially since many distributions build ImageMagick WITH Cairo and are therefore not on the vulnerable code path.

An attacker uploads or submits a crafted RSVG/SVG image to a service that uses an ImageMagick build compiled without Cairo support; during decoding the image hits a resource limit, causing the RSVG decoder to free the SVG handle twice and then access freed memory, crashing the worker process and denying service. No public exploit code was identified at the time of analysis, and because attack complexity is high (specific build configuration plus a triggered resource limit), reliable exploitation is non-trivial. The impact is limited to a crash - there is no evidence of code execution or data exposure.