ImageMagick contains a heap buffer over‑write in the EXR decoder that is triggered by a crafted EXR file. The overflow is a classic heap‑based buffer overflow (CWE‑122) and an out‑of‑bounds write (CWE‑787). When the vulnerability is exercised the decoder writes beyond the allocated buffer, causing the process to crash. This results in a denial of service for the application or system that invokes the decoder, without revealing any direct arbitrary code execution. The impact is limited to service interruption where the vulnerable image is processed.

The vulnerability affects the ImageMagick software product. Any installations of ImageMagick that use a version earlier than 7.1.2‑32 are vulnerable. Versions 7.1.2‑32 and later incorporate the fix and are not impacted.

The CVSS v3.1 score of 5.3 places this issue in the moderate severity range. The EPSS score is not yet available, and the vulnerability is not listed in the CISA KEV catalog, indicating no confirmed exploitation data to date. The likely attack vector is a local or remote process that parses an EXR image supplied by an attacker; a typical exploitation scenario involves an application loading a malicious image from the network or a file system. The requirement to supply a crafted file and the absence of privileged escalation lower the overall exploitability, but the moderate CVSS suggests caution for exposed or widely used systems.