ImageMagick contains a memory leak in the ASHLAR image writer, allowing crafted images to trigger repeated allocations of small objects that are never freed. The resulting exhaustion of process memory can cause the application or the host system to become unresponsive, effectively a denial‑of‑service condition. The weakness is classified as CWE‑401 for uninitialized memory deallocation and CWE‑772 for missing release of allocated memory after long‑term usage.

The vulnerability affects all installations of ImageMagick prior to version 7.1.2‑15. It also impacts applications that embed ImageMagick libraries, such as Magick.NET, when using older versions. Updating to ImageMagick 7.1.2‑15 or later, or to Magick.NET 14.10.3 or newer, removes the flaw.

The CVSS score of 5.3 places the issue in the medium severity range, but the EPSS score of less than 1% indicates a very low probability of exploitation in observed data. The flaw is not listed in the KEV catalog. Exploitation requires the attacker to supply a specially crafted image that employs the ASHLAR image writer. If the affected application processes images from untrusted sources—such as a web service—remote attackers can trigger memory exhaustion. In environments where image input is strictly controlled, the risk is considerably lower.