ImageMagick suffers a buffer overflow in the PNG encoder when an image contains an extremely large profile. The overflow corrupts heap memory, creating an opportunity for memory corruption if an attacker can supply the crafted image. The weakness is classified as a buffer overflow (CWE‑120) and buffer over-read (CWE‑119). Based on the description, it is inferred that the attack vector would rely on an attacker supplying a crafted image to the vulnerable PNG encoder.

Vulnerable builds of ImageMagick are any versions earlier than 7.1.2-16 for the 7.x series and earlier than 6.9.13-41 for the 6.x series. Any deployment that decodes or encodes PNG files with these versions is at risk.

The vulnerability has a CVSS score of 5.7, indicating moderate severity, and an EPSS of less than 1%, showing a very low probability of exploitation at this time. It is not currently listed in CISA’s KEV catalog. Based on the description, it is inferred that an attacker must deliver a PNG image containing an oversized profile to the vulnerable software. Successful exploitation could lead to memory corruption that may affect the stability or confidentiality of the host where the image is processed.