ImageMagick code that interprets image filenames on certain platforms fails to handle a return value correctly, causing a pointer to advance past the end of a stack buffer. This produces an out‑of‑bounds write that can corrupt adjacent memory. The result may be a program crash or, if control data is overwritten, could lead to arbitrary code execution. The weakness maps to stack buffer overflow (CWE‑121, CWE‑787, CWE‑823).

Versions of ImageMagick released before 7.1.2‑18 and before 6.9.13‑43 are affected. Any installation that was built from source during that period or still ships with those legacy artifacts is at risk. The vulnerability is not tied to a specific operating system but is platform‑dependent in its manifestation.

The CVSS score of 5.1 reflects moderate severity. The EPSS score of less than 1% suggests that real‑world exploitation is unlikely at present, and the flaw is not listed in the CISA Known Exploited Vulnerabilities catalog. Attackers would need to supply a specially crafted image file that triggers the faulty return path, typically through an application that accepts untrusted media. Until the vendor’s patch is applied, the potential for denial of service or arbitrary code execution remains. No confirmed public exploits are reported.