ImageMagick EUVD-2026-94411

Exploitation requires that the target application lets an attacker supply a MAT (MATLAB) format image that ImageMagick will decode through its MAT coder (coders/mat.c decompress_block path), and that a security-policy resource limit is relied upon to cap disk usage - the flaw is that a highly compressed MAT stream bypasses that limit by writing an oversized temporary file during zlib inflation. Limiting factors: impact is confined to availability (disk/temp-space exhaustion) with no code execution, data disclosure, or integrity loss; the practical network vector depends on the deployment accepting remote/untrusted image input (upload, conversion, thumbnailing services), whereas systems that only process trusted local images face a much narrower, effectively local exposure. Affected versions are ImageMagick before 7.1.2-30 and before 6.9.13-55.

This is a resource-exhaustion (data-amplification) flaw, not a memory-safety or code-execution issue. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) and the 5.3 Medium base score agree with the description and CWE-409 (Improper Handling of Highly Compressed Data): the only impact is availability (A:L) via excessive temporary-disk consumption - there is no confidentiality or integrity impact. No EPSS score, CISA KEV listing, or public POC was provided in the intelligence set, so there is no evidence of active exploitation or weaponization; the only 'exploit' artifacts are the upstream fix commits, which demonstrate the mechanism but are not attack code. The real-world priority is therefore moderate-to-low: although the attack vector is network-reachable and requires no authentication, the ceiling is a denial-of-service against disk space rather than compromise. One caveat to verify: AV:N assumes the affected system ingests attacker-supplied MAT files over the network (e.g., an upload/conversion service); in deployments where ImageMagick only processes trusted local images, the practical vector is closer to local and the real risk is lower. The input tag 'Authentication Bypass' conflicts with every other signal - this vulnerability bypasses a resource security-policy limit, not an authentication control - and should be disregarded as mislabeled.

An attacker uploads a specially crafted, highly compressed MAT (MATLAB) image to a service that uses ImageMagick for image processing or conversion. When ImageMagick's MAT decoder inflates the embedded zlib stream, it writes a temporary file far larger than the configured security-policy resource limit, filling the disk and degrading or denying service. No public exploit code is identified at time of analysis, but the attack is low-complexity and requires no authentication or user interaction if the service accepts remote file submissions.