A flaw in ImageMagick’s msl.c component prevents the stack index from being refreshed on error, causing an image to be stored in the wrong slot and never freed. This results in a memory leak (CWE‑401) and an uninitialized data exposure (CWE‑911). The continual leaking of memory can eventually exhaust system resources, potentially leading to denial of service for applications that rely on the library.

The vulnerability affects all installations of ImageMagick prior to release 7.1.2‑15 and 6.9.13‑40. It exists in the msl.c module that manages image stack indices, regardless of the host platform.

With a CVSS base score of 5.3 the flaw is considered moderate. The EPSS score of less than 1% indicates a very low likelihood of exploitation at the time of analysis, and the vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is through image processing operations—such as conversion, resizing, or other manipulations—performed on user‑supplied images, which may be triggered remotely if the application accepts untrusted content.