The vulnerability arises from an integer overflow in the Sun image decoder of ImageMagick. On 32‑bit builds, a deliberately crafted image can cause an out‑of‑bounds heap write, corrupting memory. This corruption can be leveraged to execute arbitrary code or crash the application, potentially allowing full system compromise.

The flaw exists in all releases of ImageMagick older than 7.1.2‑15 and 6.9.13‑40. Any system that installs one of those vulnerable versions on a 32‑bit architecture is affected. This includes web servers, batch image processors, or other services that use ImageMagick to handle user‑supplied images.

The CVSS score of 6.5 indicates a moderate severity. The EPSS score of less than 1 % suggests that exploitation is expected to be rare. The vulnerability is not listed in the CISA KEV catalog. Attackers can exploit it by providing a malicious image to any component that invokes the Sun decoder on a 32‑bit build; no network‑side capabilities are required beyond delivering that image. Because the flaw leads to memory corruption, it can result in remote code execution, but only if the attacker can run ImageMagick with sufficient privileges.