Technical impact
The vulnerability in ImageMagick occurs when the -set profile option is used and a cleanup routine is omitted, causing a memory leak. An attacker who brings a user to process images containing the -set profile flag can repeatedly trigger the leak, eventually exhausting the system's memory and resulting in a denial of service. The flaw is a type of memory management weakness (CWE-401 and CWE-772).
Affected Systems
ImageMagick versions prior to 6.9.13-58 and 7.x prior to 7.1.2-33 are affected. The issue applies to any installation using the open-source ImageMagick software, regardless of platform, that processes images with the -set profile command.
Risk and Exploitability
The CVSS base score is 4.8, indicating moderate severity, and the EPSS score is not available, so the exploit probability is unknown. The vulnerability is not listed in CISA KEV, suggesting it has not been widely reported as exploited. Exploitation requires an attacker to cause the user to process a crafted image with the -set profile flag, so the attack vector is likely indirect through user interaction or a social‑engineering scenario. If successful, the memory exhaustion will lead to process termination or system instability, producing a denial of service.
