A heap buffer overflow exists in the XBM image decoder of ImageMagick prior to versions 7.1.2-13 and 6.9.13-38. The flaw is triggered when the decoder processes a maliciously crafted XBM file, causing it to write attacker‑controlled data beyond the bounds of a heap buffer. This allows an attacker to corrupt memory and potentially execute arbitrary code, falling under CWE‑122 and CWE‑190 weaknesses.

The vulnerability affects the ImageMagick image manipulation suite. All releases of ImageMagick older than 7.1.2-13 and 6.9.13-38 are impacted. The fix is delivered in ImageMagick 7.1.2‑13 and 6.9.13‑38 and later builds.

The CVSS score of 8.1 indicates high severity, and the EPSS score of less than 1% suggests low current exploitation probability, though the flaw remains unpatched in many deployments. Any operation that reads or identifies an XBM image—such as image upload, thumbnail generation, or format conversion—can trigger the overflow. Exploitation requires the ability to supply a crafted XBM file to the ImageMagick decoder, which many web services, content management systems, or image processing pipelines provide.