Technical impact
The vulnerability involves a failure to release memory after it has reached its effective lifetime within MolotovCherry Android-ImageMagick7, causing a memory leak. This weakness, identified as CWE-401, may allow an attacker to exhaust memory resources or access residual data left in memory, potentially compromising data confidentiality or application stability.
Affected Systems
The affected product is MolotovCherry Android-ImageMagick7. Versions prior to 7.1.2-11 are impacted. No other vendors or product variants are listed.
Risk and Exploitability
The CVSS score of 7.5 indicates a high severity impact, while the EPSS score of less than 1% suggests a low probability of widespread exploitation. Because the vulnerability is not included in the CISA KEV catalog, it is likely not currently in active use by known threat actors. Exploitation would most likely require an attacker to supply a specially crafted image to an application that employs the affected version of Android-ImageMagick7, potentially allowing the attacker to trigger the memory leak or read residual memory contents. The available information does not indicate a remote code execution vector, but the high CVSS score reflects the significant impact of resource exhaustion or data exposure.
