ImageMagick versions before 6.9.13-57 and before 7.1.2-32 contain a memory leak in the GIF encoder caused by failing to release allocated memory when color quantization errors occur during image conversion. Each failed quantization attempt consumes additional memory, which over time can exhaust system resources and degrade availability for legitimate users. The weakness is identified as improper release of resources (CWE-401).

The vulnerability affects all installations of ImageMagick that run a build older than 6.9.13-57 or 7.1.2-32, regardless of operating system, including Linux, Windows, macOS, and embedded platforms that rely on ImageMagick for image processing tasks.

The CVSS score of 6.3 indicates a medium severity. An attacker who can access the GIF encoder interface can supply crafted images that trigger quantization failure, causing the memory leak and progressively draining resources. No EPSS data is available, and the vulnerability is not listed in CISA KEV, suggesting that large‑scale exploitation has not yet been observed, but the availability impact makes the threat material if the service is exposed.