ImageMagick contains a heap‑based buffer overflow in its UHDR encoder that occurs when a truncated value is processed. The overflow writes beyond the intended buffer, potentially overwriting adjacent memory structures. This corruption can lead to unpredictable behavior or, in the right circumstances, code execution.

All ImageMagick releases prior to version 7.1.2‑16, including both the 7.x mainline and earlier 6.x branches, are affected. Any installation that accepts UHDR image input without the patch is vulnerable.

The flaw has a CVSS v3.1 score of 6.8, placing it in the moderate severity range. Exploit probability is reported as less than 1%, indicating low likelihood of successful attacks at present, and it does not appear in the CISA catalog of known exploited vulnerabilities. Attackers would need to supply a crafted UHDR image, suggesting the vector could be via a malicious file supplied remotely or by a local untrusted source. No additional exploitation conditions are documented beyond the requirement to invoke the UHDR encoder.