The vulnerability is a heap use‑after‑free in ImageMagick’s MSL decoder. By crafting a malicious MSL file, an attacker can trigger access to freed memory, potentially causing a crash or unexpected application behavior. The core weakness is captured by CWE‑416 and CWE‑825, and may lead to denial of service or, in some exploitation scenarios, remote code execution if the freed memory can be overwritten.

All ImageMagick releases older than 7.1.2‑16 and 6.9.13‑41 are affected. Systems that still run those legacy versions need to update to the patched releases to eliminate the flaw.

The CVSS base score of 5.3 indicates moderate severity. The EPSS score is reported as less than 1 %, meaning exploitation likelihood is low but not impossible. The vulnerability is not listed in the CISA KEV catalog, so no large‑scale attacks have been documented. The attack vector appears to be local file processing; an attacker must supply a crafted MSL image to the vulnerable ImageMagick instance, and no explicit authentication is required by the description.