ImageMagick has a possible stack buffer overflow in its sixel encoder. When a memory allocation fails during sixel encoding, the program can write beyond the end of a stack buffer, potentially corrupting memory. This flaw is a classic stack buffer overflow (CWE-121) that could lead to exploitation such as arbitrary code execution or program termination, depending on the attacker's control over the input.

Affected product is ImageMagick. Versions before 7.1.2-16 and before 6.9.13-41 are vulnerable. The vulnerability is fixed in ImageMagick 7.1.2-16 and 6.9.13-41.

The CVSS severity is 6.7 (Medium). EPSS indicates a very low likelihood of exploitation (<1%). It is not listed in the CISA Known Exploited Vulnerabilities catalog. The likely attack vector involves processing a malicious sixel-encoded image; therefore, local or remote attacker with ability to submit such data to the vulnerable ImageMagick instance could exploit the flaw.