Technical impact
The vulnerability is a missing release of memory after its effective lifetime, leading to a memory leak. It can allow an attacker to cause resource exhaustion, potentially resulting in application slowdown or crash. The weakness corresponds to CWE-401, a classic memory management issue.
Affected Systems
The issue affects MolotovCherry's Android-ImageMagick7 prior to version 7.1.2-11. Any system using the library before that release is potentially vulnerable.
Risk and Exploitability
With a CVSS score of 7.5, the vulnerability is considered high severity. The EPSS score is below 1 % and it is not listed in CISA's KEV catalog, suggesting low current exploitation probability. Exploitation would likely require the attacker to supply a specially crafted image or image data that forces the library to allocate memory without releasing it, leading to gradual depletion of system resources. The attack vector is probably local or application‑internal, depending on how the library is integrated.
