ImageMagick’s SIXEL decoder contains a signed integer overflow in its buffer reallocation logic, which corrupts memory and causes the decoder to crash when processing a malicious image. The weakness is identified as an integer overflow (CWE‑190). The effect is a denial of service because the crash terminates the image processing routine and may destabilize the application that called it. The likely attack vector is delivering a crafted SIXEL image file to a program that uses ImageMagick, which is inferred from the description because the vulnerability is triggered during image decoding.

All releases of ImageMagick older than 7.1.2‑15 in the 7.x line and older than 6.9.13‑40 in the 6.x line are affected. Users running these versions should be aware that the vulnerable SIXEL decoder is present and could be executed when processing image files.

The CVSS score of 5.3 indicates moderate severity, while the EPSS score of less than 1 % shows a very low but nonzero likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires delivering a crafted image file; a local user with write access to a location that an application later reads could trigger the crash, and a remote attacker could target services that accept user‑supplied images if those services load them with ImageMagick. These exploitation possibilities are inferred from the description that the overflow occurs during image decoding. The impact remains limited to denial of service, with no indication of additional confidentiality or integrity compromise.