ImageMagick, a widely used open‑source image processing library, contains a use‑after‑free vulnerability in its RSVG decoder. The flaw manifests only when the library is built without Cairo support and a specially crafted RSVG file that exceeds a resource limit is processed. The decoder frees the same memory region twice and then accesses it, causing the image processing thread to crash. The crash terminates the process, leading to a denial of service for any application that relies on ImageMagick to handle such images.

All installations of ImageMagick prior to version 7.1.2-30 and 6.9.13-55 that are compiled without Cairo support are susceptible. This includes builds on Linux, Windows, macOS, and any other platform where ImageMagick is used to process RSVG files. The problem is resolved in releases 7.1.2-30 and 6.9.13-55 and later, as well as in any subsequent versions that incorporate the fix.

The CVSS score of 5.9 denotes moderate severity; the EPSS score is not available, so the likelihood of exploitation is unknown. Since the issue results in a crash rather than arbitrary code execution, it is not currently listed in CISA’s Known Exploited Vulnerabilities catalog. Attackers would need a means to deliver a malicious RSVG file to a system that processes images—either via remote upload to a web service or local execution of image manipulation. No remote code execution capability is reported, so the primary risk is service interruption rather than full system compromise.