ImageMagick versions prior to 6.9.13-57 and 7.x before 7.1.2-32 contain a memory leak in the YUV encoder component. When a particular operation fails, the encoder does not release allocated memory. An attacker can supply crafted image data that provokes the failing operation, causing memory to accumulate until system resources are exhausted, which may lead to application termination or abnormal responses.

The vulnerability affects ImageMagick products produced by the ImageMagick project. Affected builds include any release prior to 6.9.13‑57 for the 6.x branch and any 7.x release before 7.1.2‑32. The issue is present in the core ImageMagick library that processes YUV formats.

The CVSS score of 6.3 indicates moderate severity. Because the attack requires a crafted input image, it is likely to be executed by an attacker who can influence the data passed to ImageMagick, such as via a CGI script or web service that accepts user images. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting that widespread exploitation has not yet been documented. Nevertheless, the memory exhaustion can lead to a denial of service that impacts availability of services relying on ImageMagick.