Technical impact
ImageMagick versions before 7.1.2‑33 have a heap buffer overflow on 32‑bit platforms that occurs when convex‑hull information is requested. An attacker can craft an image to trigger this overflow, allowing overwrite of heap memory. The effect is potential crashes and, in the worst case, code execution from corrupted memory. The weakness is a classic buffer overflow, identified as CWE‑190 and CWE‑787.
Affected Systems
The vulnerability affects ImageMagick installations running the ImageMagick product on 32‑bit operating systems that use any version earlier than 7.1.2‑33. The advisory does not specify additional product variants, so any deployment of this legacy version on 32‑bit hardware is included.
Risk and Exploitability
The assigned CVSS score of 2.0 indicates a low severity level. EPSS information is unavailable and the vulnerability is not listed in the CISA KEV catalog, suggesting limited known exploitation. Attackers must supply a malicious image that is processed via the convex‑hull routine, which typically requires application‑level control over image input. While the flaw can cause crashes and potentially allow arbitrary code execution, the lack of a remotely exploitable path and the low CVSS score imply a moderate to low risk for most users.
