The vulnerability is a use‑after‑free in the MSL interpreter of ImageMagick that occurs when an invalid `<map>` element is processed. A malformed image triggers a crash and corrupts memory, potentially allowing an attacker to execute arbitrary code or cause denial of service. The flaw is classified as CWE‑416 (Use After Free), with additional weaknesses identified as CWE‑476 (NULL Pointer Dereference) and CWE‑825 (Logical Error).

Versions of ImageMagick prior to 7.1.2‑15 and 6.9.13‑40 are impacted. All builds of the ImageMagick software that include the MSL interpreter and accept `<map>` elements fall into this range. The affected vendor is ImageMagick itself, and no other third‑party packages are listed.

The CVSS score of 5.3 indicates moderate severity. The EPSS score of less than 1 % suggests a low probability of exploitation at this time, and the vulnerability is not present in the CISA KEV list. The attack vector is inferred to require the attacker to supply a crafted image or MSL script that contains an invalid `<map>` element to a system running a vulnerable version of ImageMagick. If such input originates from a remote source, the risk increases. The overall risk is moderate but mitigated by the low exploitation likelihood and the availability of a patch.