The vulnerability is a null pointer dereference in ImageMagick's PostScript decoder. The flaw is triggered when a policy limit is reached during parsing of a PostScript file. This defect, categorized as CWE‑476, can cause the application to crash.

Affected versions are ImageMagick 7.1.1‑31 through 7.1.2‑31 inclusive. The product is the ImageMagick image manipulation library, used in many web servers, content management systems, and automation tools that parse PostScript input. Any deployment that processes user supplied PostScript data will be impacted.

The CVSS score of 6.3 indicates a moderate impact, and the vulnerability is not listed in the CISA KEV catalog. Because the exploit requires an attacker to supply a crafted PostScript document to the decoder, the likely attack vector is via endpoints that accept user content, such as uploading files or rendering user generated graphics. The lack of an EPSS score limits quantitative risk comparison, but the moderate CVSS and mandatory policy check suggest that crash‑based denial of service is the primary threat.