ImageMagick prior to version 6.9.13-57 and 7.x before 7.1.2-32 contains a use‑after‑free flaw in the PDF writer when handling CMYK images compressed with JPEG2000. A crafted CMYK raster can trigger allocated memory to be freed and subsequently reused during the JPEG2000 processing step, leading the process to crash. The vulnerability does not provide direct remote code execution or data disclosure; its impact is primarily a denial‑of‑service condition for the target process.

The issue affects the ImageMagick software suite. Vulnerable builds are any 6.x releases older than 6.9.13-57 and any 7.x releases older than 7.1.2-32. The problem is present in the PDF writer component that handles JPEG2000‑compressed CMYK images.

The flaw carries a CVSS score of 6.3, indicating a moderate severity. There is no EPSS data available, and the vulnerability has not been listed in the CISA KEV catalog. Attackers would need to supply a malicious PDF (or PNG, etc.) that exercises the PDF writer's JPEG2000 CMYK path, which is likely a local or remote file‑processing scenario. Because the vulnerability is limited to the specific image‑compression pipeline and only causes a crash, exploitation chances are moderate and the impact is confined to denial of service rather than data compromise.