ImageMagick, widely used for image editing, contains a heap buffer overflow in its SFW decoder when parsing extremely large images on 32‑bit systems. The overflow can trigger a process crash, resulting in a denial of service. The weakness is identified as CWE‑122, an out‑of‑bounds write that corrupts heap memory.

The issue affects all 32‑bit installations of ImageMagick versions released prior to 7.1.2‑16 on the 7.x branch and prior to 6.9.13‑41 on the 6.x branch. Any environment running those earlier builds is vulnerable, regardless of operating system.

The CVSS score of 5.7 indicates moderate severity. EPSS reports an exploitation likelihood of less than 1%, and the vulnerability is not listed in the CISA KEV catalog. Attackers can exploit the flaw by providing a crafted, oversized image to any process that uses the SFW decoder, either remotely or locally depending on who can influence image input. The exploit path is straightforward: submit the large image, trigger the overflow, and cause a crash, leading to denial of service.