ImageMagick, a widely used open‑source image manipulation library, contains a NULL pointer dereference flaw in the Magick Scripting Language parser. The issue is triggered when a <comment> tag is parsed before an image is loaded, causing an assertion failure in debug builds or a NULL dereference in release builds. The resulting crash can interrupt services that rely on ImageMagick or its .NET bindings, effectively creating a denial‑of‑service vulnerability. The weakness is classified as CWE‑476 (NULL Pointer Dereference).

Affected products include the ImageMagick software itself and the Magick.NET .NET wrapper. Versions 14.10.1 and earlier are vulnerable; the flaw is addressed in ImageMagick 14.10.2 and the corresponding Magick.NET 14.10.2 release. No other products or versions are identified in the current advisory.

The vulnerability received a CVSS score of 6.5, indicating moderate severity, while the EPSS score is below 1 %, pointing to a low exploitation probability. It is not listed in the CISA KEV catalog. Based on the description, it is inferred that the attacker would need to supply a crafted image file that contains a <comment> tag before the image data. This typically implies a local or privileged context unless the target application allows remote image uploads. Given the current metrics, the risk is moderate but still warrants timely mitigation.