ImageMagick, a free and open‑source image processing library, contains a heap‑buffer‑overflow vulnerability in its PCL encoder. The flaw arises from an undersized output buffer allocation, which allows an attacker to corrupt memory and potentially execute arbitrary code. This weakness corresponds to CWE‑122 and CWE‑131.

The vulnerability affects all ImageMagick releases prior to 7.1.2‑16 and 6.9.13‑41. These older versions are susceptible when any image is processed using the PCL encoder component. Only the releases mentioned above incorporate the required fix.

The CVSS base score is 6.8, indicating moderate severity, while the EPSS score is below 1%, suggesting a low likelihood of exploitation at present. The vulnerability is not listed in the CISA KEV catalog. An attacker could trigger the overflow by supplying a malicious image to an application that embeds ImageMagick, and, based on the description, the most likely attack vector is image‑based exploitation that could result in remote code execution. Current patching mitigates all known risks.