ImageMagick processes images that may contain scripts written in the proprietary MSL language. In versions prior to 7.1.2‑15 and 6.9.13‑40 the library does not detect circular references between two MSL files, which is an example of improper input validation (CWE‑606) that permits unchecked recursion (CWE‑674) and results in a stack buffer overflow (CWE‑787). When an attacker supplies a pair of scripts that reference each other, the recursive processing causes a stack overflow. The overflow corrupts stack memory and crashes the application, producing a denial of service. No confirmed exploitation that leads to code execution is described in the advisory.

The vulnerability affects the ImageMagick image processing library. All releases before 7.1.2‑15 and before 6.9.13‑40 are vulnerable. The patch is included in 7.1.2‑15 and 6.9.13‑40.

The CVSS score of 6.2 indicates moderate severity. The EPSS score is reported as less than 1 %, implying a very low chance of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is the delivery of malicious MSL files to an ImageMagick instance that processes images, typically occurring when the software is exposed in a server or web service that accepts uploaded images. Because the flaw triggers a stack overflow, the primary risk is denial of service; the advisory does not confirm any further impact such as code execution.