ImageMagick 7.1.2-30 through 7.1.2-31 contains a use-after-free flaw in the WBINFO decoder. When decoding an image, a failed memory allocation triggers a free of a buffer that can then be accessed again during the same operation. An attacker can craft an image that triggers this path, causing the application to crash via a use-after-free execution error.

The vulnerability affects ImageMagick 7.1.2-30 up to, but not including, 7.1.2-32. Systems running any of these releases that process untrusted images are impacted. The problem exists in the WBINFO image format decoder provided by the main ImageMagick package.

The CVSS base score is 6.3, indicating a moderate impact. The EPSS score is not available, so the current probability of exploitation is unknown. The vulnerability is not listed in CISA KEV. Attackers must supply a crafted image that triggers a memory allocation failure; therefore, exploitation is possible when the target process decodes such an image, either locally or from a remote source, resulting in a denial of service by crashing the ImageMagick process.