The vulnerability is a race condition due to improper synchronization when the security policy is accessed concurrently, causing a heap buffer over‑write. When an attacker can trigger concurrent policy reads and writes, the overflow can crash ImageMagick, leading to a denial of service. This weakness is classified as a race condition (CWE‑362) and a buffer overflow (CWE‑787).

ImageMagick releases prior to 6.9.13‑57 and 7.x before 7.1.2‑32 are affected. The issue occurs in the core image‑processing library used by applications on Windows, macOS, and Linux. Any installation that uses the vulnerable policy file runs multi‑threaded processing is at risk.

Though the CVSS score of 2.0 indicates low overall severity, the impact manifests as a denial of service when an attacker can provoke concurrent policy access. The description does not state a concrete attack vector; based on the details, the likely vector involves a multi‑threaded application that accesses the security policy concurrently, such as a web server processing image uploads. EPSS data is not available, so the exploitation probability remains unknown. The vulnerability is not listed in the CISA KEV catalog, indicating no widespread known exploits to date, yet environments that expose ImageMagick to untrusted input should mitigate the risk of service outages.