ImageMagick EUVD-2026-97579

Exploitation requires local, low-privilege ability to invoke ImageMagick's -script operation (PR:L, AV:L, UI:N), and is only meaningful in deployments that rely on ImageMagick's configured security policy (policy.xml) as a containment boundary for untrusted operations. The specific prerequisite is use of the -script feature where the handling of file descriptors not opened by the current operation was previously unchecked (versions before 7.1.2-32). Limiting factors: no remote vector, authenticated/low-privilege access needed, impact confined to availability (VA:L) with no confidentiality or integrity effect and no scope change to other systems; environments that do not expose -script to untrusted input or do not depend on policy restrictions are not materially affected.

This is a genuinely low-to-medium priority issue, and the signals are internally consistent rather than conflicting. The supplied CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L) scores 4.8 and describes a LOCAL, low-privilege attack with no confidentiality or integrity impact and only LOW availability impact confined to the vulnerable system - there is no scope change to other systems (SC/SI/SA:N). No EPSS score was provided, the CVE is not in CISA KEV, and no public exploit was referenced, so there is no public exploit identified at time of analysis. The mechanism is a policy bypass: ImageMagick's -script operation can close file descriptors it did not open, circumventing restrictions administrators thought were enforced by the security policy. Because impact is limited to availability (closing descriptors), and the attacker already needs the ability to run ImageMagick with -script locally, this is a hardening/defense-in-depth weakness rather than a direct path to code execution or data theft. The 'Authentication Bypass' tag overstates the issue - the description describes bypass of a configured security POLICY, not authentication. Net: real and worth patching in environments that depend on ImageMagick policy restrictions as a sandbox boundary, but not an emergency.

An attacker who can already submit or invoke ImageMagick operations (for example via a service that processes user-supplied conversion scripts under a restrictive policy.xml) crafts a -script operation that closes file descriptors it never opened. This circumvents the configured security policy's intended containment, potentially disrupting the handling of resources the operation was supposed to be sandboxed away from. No public exploit was referenced in the provided data.