This vulnerability arises in ImageMagick versions older than 7.1.2‑13 when the BilateralBlurImage method allocates a set of double buffers. The last buffer in the set is not initialized correctly. When a memory allocation fails, the invalid pointer is later released during DestroyBilateralTLS, causing a segmentation fault. The weakness can be identified as an improper release of memory resources (CWE‑763). Compromise can result in application crashes that lead to denial of service.

The affected product is ImageMagick. Any installation that is not at least version 7.1.2‑13 is vulnerable. The vulnerability affects all platforms where ImageMagick executes the BilateralBlurImage function, including command‑line tools and libraries used in image processing pipelines.

The CVSS score is 6.5, indicating moderate severity. The EPSS score is below 1%, indicating a very low expected exploitation probability, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is local or remote via a crafted image that triggers the BilateralBlurImage routine, which would cause the application to crash. Although the description does not confirm remote code execution, the presence of a faulty pointer release could destabilize the process if the attacker can influence memory allocation outcomes. Current mitigations rely on patching.