Technical impact
ImageMagick versions earlier than 7.1.2-33 contain a memory leak in the FPX encoder. The flaw permits attackers to craft an image that, when encoded to FPX format, repeatedly leaks memory, gradually exhausting the system’s memory resources. The resulting denial of service can affect the availability of the application or server hosting ImageMagick, potentially impacting all processes sharing the same memory pool.
Affected Systems
The vulnerability is confined to ImageMagick releases prior to 7.1.2-33. The affected product is ImageMagick ImageMagick, specifically any build that includes the FPX encoder component and has not applied the 7.1.2-33 patch or later.
Risk and Exploitability
The CVSS score of 2.3 indicates a low severity rating, reflecting that the flaw does not allow direct code execution or compromise of confidentiality. However, because an attacker can provide a crafted image and trigger the leak, remote denial of service is possible if the FPX encoder is exposed over a network or through user-supplied content. The EPSS score is not available, and the vulnerability is not listed in CISA KEV, suggesting no known high‑profile exploitation. Nevertheless, the impact on availability warrants timely remediation, especially in environments that accept untrusted image inputs.
Debian DLA