ImageMagick implements an MNG encoder with missing bounds checks that can corrupt the stack with attacker-controlled data. The flaw is a classic stack buffer overflow (CWE‑121) and, if successfully exploited, could allow an attacker to execute arbitrary code on a system where ImageMagick processes the vulnerable image. The official description notes the potential for stack corruption but does not specify confirmed remote code execution, so the impact is inferred as a possibility to compromise confidentiality, integrity, and availability by executing code with the privileges of the ImageMagick process.

ImageMagick versions older than 7.1.2‑16 and 6.9.13‑41 are affected. The vulnerability exists in the core ImageMagick software used for image editing and manipulation, and any deployment that relies on older releases is at risk.

The CVSS score of 6.9 indicates moderate severity, while the EPSS score shows a very low but nonzero likelihood of exploitation. The vulnerability is not listed in CISA’s KEV catalog. Exploitation requires the ability to process a crafted MNG image; therefore the most likely attack vector is via an application or service that accepts image input (e.g., a web server or media processing pipeline) and runs ImageMagick with it. This insight is inferred from the nature of the vulnerability, as the description does not explicitly state an attack vector.