ImageMagick EUVD-2026-97705

Exploitation requires that the target application invoke ImageMagick's GIF encoder (i.e., convert or write attacker-influenced images to GIF output) and that color quantization fail during that encoding - the specific code path in WriteGIFImage (coders/gif.c) that previously threw MemoryAllocationFailed without freeing global_colormap, colormap, and write_info. Limiting factors: the output/target format must be GIF, the attacker must be able to supply or influence the image converted, and each attempt leaks only a bounded amount of memory, so meaningful impact requires many repeated conversions; there is no code execution, no data exposure, and no privilege gain. Affected versions are ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32.

This is a genuine but modest-severity availability issue, not a top-tier priority. The vendor-supplied CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:N/UI:N) scores it 6.3 (Medium) with the ONLY impact being VA:L - low availability - and VC:N/VI:N confirming no confidentiality or integrity loss, consistent with a CWE-401 missing-memory-release (leak) rather than information disclosure. The AT:P (attack requirements present) metric correctly reflects that exploitation depends on the attacker inducing color-quantization failure during GIF encoding, so it is not a trivially reliable one-shot DoS; impact accrues gradually as memory leaks per failed attempt. There is no CISA KEV listing and no public exploit code identified at time of analysis, and no EPSS score was provided, so there is no signal of active or widespread exploitation. The commit diff confirms the root cause and fix (freeing global_colormap, colormap, and write_info before throwing the error), corroborating the description. Note a metadata conflict: the input Tags label this 'Information Disclosure,' which contradicts both CWE-401 and the CVSS impact profile (VC:N) - this is an availability/resource-exhaustion bug, not disclosure.

An attacker repeatedly submits crafted images to a web service or pipeline that converts uploads to GIF using ImageMagick, choosing input that causes color quantization to fail during encoding. Each failed conversion leaks a chunk of unreleased memory, and over many requests this gradually exhausts available memory and degrades or crashes the service. No public exploit code is identified, and the leak-per-attempt nature means impact is cumulative rather than immediate.