Technical impact
ImageMagick prior to version 7.1.2-33 contains a memory leak in the MAT decoder’s error handling path. A crafted MAT file can trigger the error, causing the decoder to allocate memory that is never freed. Each failure leaks a small amount of memory and, when repeated many times, can exhaust the memory available to the ImageMagick process. This gradual exhaustion can degrade or terminate services that rely on image processing, resulting in a denial of service.
Affected Systems
All installations of ImageMagick older than 7.1.2-33 that use the MAT decoder are affected. The vulnerability applies regardless of host platform or deployment scenario, as long as the vulnerable build processes MAT files.
Risk and Exploitability
With a CVSS score of 6.9 the vulnerability is classified as moderate. The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is to supply a malicious MAT file to the vulnerable process, such as through a file upload endpoint or an API that accepts image data. Based on the description, it is inferred that no special authentication is required; the attacker only needs the ability to provide a MAT file to the ImageMagick instance. Because the flaw causes a cumulative leak, repeated requests can gradually consume process memory and lead to a denial of service. The absence of authentication requirements lowers the barrier to exploitation, making the risk significant if file handling is not restricted or monitored.
