A crafted Microsoft Scripting Language (MSL) file can trigger a heap-use-after-free in ImageMagick’s MSLStartElement handler. When the operation element replaces and frees an image, the parser continues to read from the released memory, causing a use-after-free during a subsequent ReadBlobString. This memory corruption vulnerability may lead to application crashes or, in a worst‑case scenario, arbitrary code execution if the corrupted state is exploitable. The weakness is identified as CWE-416 and CWE-825.

ImageMagick versions prior to 7.1.2-15 and 6.9.13-40 are affected. The vulnerability resides in the core image processing library and applies to any deployment that processes MSL scripts, including web applications, content management systems, or other services that manipulate images with ImageMagick.

The CVSS score of 5.3 indicates moderate severity, while the EPSS score of less than 1% shows a low probability of exploitation in the near term. The vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is the injection of a malicious MSL script that an application processes during image handling, inferred from the description of the vulnerability. Consequently, systems that use ImageMagick for image processing should assess exposure, apply the recommended patch, and monitor for anomalous activity.