ImageMagick EUVD-2026-97704

Exploitation requires repeatedly invoking ImageMagick's PNG encoder (coders/png.c WriteOnePNGImage) specifically in the state where libpng initialization fails - i.e., when png_create_write_struct/related allocation returns failure - which triggers the ResourceLimitError path that leaks the image and image_info structures. The key limiting factor is that this failure path is not reached in normal operation: libpng init failure generally requires the system to already be experiencing memory-allocation failures, so the attacker must drive the host toward memory exhaustion (for example via many concurrent or large encodes) to enter and then compound the leak. The affected surface is any application/version before 6.9.13-57 or 7.x before 7.1.2-32 that performs PNG encoding on attacker-influenced input (upload processing, thumbnailing, format conversion). No authentication is indicated by the vector (PR:N), and no user interaction is required (UI:N), but the AT:P attack requirement reflects the dependency on the induced libpng-initialization-failure condition.

This is a medium-severity availability-only issue (vendor CVSS 4.0 base 6.3) with modest real-world priority. The CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:N/UI:N) indicates a network-reachable, unauthenticated vector, but the AT:P flag correctly signals a non-trivial attack requirement: the leak only occurs on the error path when libpng initialization FAILS, a condition that does not arise during normal operation and typically presupposes the host is already under memory-allocation pressure. Impact is confined to availability (VC:N/VI:N/VA:L) - no confidentiality or integrity exposure, and only partial/low availability degradation via gradual memory exhaustion rather than an outright crash. No EPSS score was provided in the input, so exploitation-probability cannot be quantified; the CVE is NOT in CISA KEV and no public exploit was supplied (only the vendor patch commits). The source diff confirms the root cause (image_info/image not destroyed before ThrowWriterException), so the bug is real and well-understood, but the dependency on an induced allocation-failure state makes reliable weaponization awkward. Net: a legitimate hardening fix to apply during normal patch cycles, not an emergency - the combination of availability-only low impact, a required rare triggering condition (AT:P), and no evidence of exploitation outweighs the network-reachable unauthenticated surface.

An attacker repeatedly submits images to an internet-facing service that re-encodes output as PNG (e.g., an upload/thumbnail or format-conversion pipeline backed by ImageMagick). By driving the host toward memory-allocation failure so that libpng initialization fails on each request, each failed encode leaks the image and image_info structures, cumulatively exhausting memory and degrading or denying service. No public proof-of-concept was provided in the input, and reliable triggering depends on inducing the allocation-failure condition.