ImageMagick EUVD-2026-97708

Exploitation requires the target application to pass an attacker-controlled MVG file - or an SVG that invokes MVG rendering - through ImageMagick's MVG decoder; the crafted file must contain nested/recursive image or drawing references deep enough to exhaust the stack. The MVG/SVG coders are present in default ImageMagick builds, so no special configuration is needed, but the application must actually route untrusted input into image decoding (e.g., an upload, conversion, or thumbnailing pipeline). Limiting factors: impact is confined to a denial of service (process crash) with no confidentiality or integrity effect and no code execution; the AT:P metric reflects that the vulnerable decode path must be reached, so deployments that never process MVG/SVG content or that run ImageMagick only on trusted local files have minimal realistic exposure.

This is a medium-severity denial-of-service issue (CVSS 4.0 base 6.3), not a critical priority. The strongest signals are consistent and point to limited impact: CVSS impact is availability-only (VC:N/VI:N/VA:L) with no confidentiality or integrity effect, and CWE-674 (uncontrolled recursion) producing stack exhaustion aligns with a process crash rather than code execution. The vector is network-reachable and unauthenticated (AV:N/PR:N/UI:N), which raises exposure, but the AT:P (attack requirement present) metric indicates exploitation is conditioned on the target actually routing attacker-controlled input through the vulnerable MVG decoder. There is no EPSS score, no CISA KEV listing, and no public exploit code supplied in the input, so there is no evidence of active exploitation - treat this as a patch-in-normal-cycle item rather than an emergency, though its high real-world prevalence (ImageMagick is extremely common in server-side image pipelines) argues for timely patching. Signals are internally consistent; the only caveat is that AV:N assumes ImageMagick is exposed to remote/untrusted input (e.g., upload processing), whereas a purely local CLI use case would effectively be local attack surface - verify against your actual deployment.

An attacker uploads a crafted MVG file (or an SVG that drives MVG drawing) containing deeply nested recursive image/drawing references to a web service that uses ImageMagick to convert or thumbnail user-supplied images. When ImageMagick's MVG decoder parses the file, recursion depth grows until the program stack is exhausted and the worker process crashes, denying service to legitimate users. No public exploit code was identified in the provided data, and the impact is limited to a crash (no code execution).