ImageMagick parses morphology kernel strings into fixed-size stack buffers without bounds checking. When a user provides a kernel name or array longer than the buffer, the data is copied by memcpy, corrupting the stack. Stack corruption can overwrite control data and allow an attacker to execute arbitrary code, potentially compromising the system or application using ImageMagick.

ImageMagick installations older than version 7.1.2-16 or 6.9.13-41 are affected. Any deployment that processes untrusted image data with morphology operations and runs a vulnerable version of ImageMagick is at risk.

The vulnerability carries a CVSS score of 7.1 and an EPSS score of less than 1 %, indicating a moderate to high severity but a low likelihood of exploitation. It is not listed in CISA’s KEV catalog. Exploitation would require an attacker to supply a crafted image that includes a long morphology kernel name or array, so the most plausible attack vector is the processing of untrusted image files. Successful exploitation could lead to arbitrary code execution or application crashes.