The vulnerability lies in the way ImageMagick’s PostScript coders handle unescaped or untrimmed input values. When these values are passed directly into the generated PostScript output, an attacker can inject arbitrary code that will be interpreted by the PostScript engine. This flaw is a classic example of CWE‑94 and allows the execution of the embedded code, compromising the integrity of image processing and potentially enabling broader system compromise.

All installations of ImageMagick earlier than version 7.1.2‑31 and 6.9.13‑56 are affected. The vulnerability applies to any deployment that uses the PostScript coders on untrusted input, regardless of the platform or configuration.

The CVSS score of 5.3 indicates a moderate severity. The EPSS score is not available and the flaw is not listed in the CISA KEV catalog, suggesting limited known exploitation. The attack vector is inferred to be either local or remote; applications that accept user‑supplied images (or PostScript data) and process them through ImageMagick may be exploited by supplying crafted PostScript input that triggers the code injection.