ImageMagick contained a NULL pointer dereference in the ClonePixelCacheRepository function. An attacker who supplies a specially crafted image file can trigger a crash in any application linked with ImageMagick, causing the application to terminate unexpectedly. This flaw permits remote denial of service via the image processing path and is classified as CWE-476.

The vulnerability affects the ImageMagick image processing library. All releases prior to 7.1.2-15 and 6.9.13-40 are vulnerable. Systems that incorporate these older ImageMagick versions process untrusted images from any source, including remote network connections or third‑party content, making them susceptible.

With a CVSS score of 5.3 the flaw represents a medium‑severity risk. The EPSS score is below 1% and the vulnerability is not listed in CISA’s KEV catalog, indicating low exploitation likelihood at present. However, because the attack vector is simply an uploaded or received image, an attacker can launch the exploit without special privileges, making the attack path straightforward if the software is exposed to external image inputs.