A heap buffer overflow exists in the WaveletDenoiseImage function of ImageMagick that allows a crafted image to trigger an out‑of‑bounds write. If an application uses the -wavelet-denoise operation on a malicious image, memory corruption can occur, potentially resulting in application crash or, in the worst case, arbitrary code execution. The flaw exists in all releases before 7.1.2‑16 and 6.9.13‑41.

ImageMagick versions prior to 7.1.2‑16 and 6.9.13‑41. The software is widely deployed for image processing on servers, desktops, and embedded systems.

The assessed CVSS score of 5.5 indicates moderate severity, suggesting that while exploitation may not be trivial, the presence of a heap overflow can be damaging. The EPSS score of less than 1 % indicates a low likelihood of exploitation at the time of analysis. The vulnerability is not listed in the CISA KEV catalog. Attackers likely require that a compromised or untrusted image be processed by an ImageMagick‑based application, implying a local or remote file‑based vector depending on how the image is supplied. No public exploit code is available according to the provided references.