Parsing of an XML file in ImageMagick may trigger a heap buffer overflow that writes a single zero byte past the end of an allocated buffer. This overrun can corrupt memory, potentially leading to unstable system behavior or higher‑level exploitation such as local code execution. The flaw is classified under the CWE identifiers for heap buffer overflow (CWE‑122), signed integer overflow (CWE‑191), and out‑of‑bounds write (CWE‑805). The CVSS score for this vulnerability is 5.3, indicating a medium severity.

The affected product is ImageMagick. Versions earlier than 7.1.2-189 and 6.9.13-44 are vulnerable. ImageMagick developers have issued a fix that was released in version 7.1.2‑19 and in 6.9.13‑44, effectively removing the error from later builds.

With a CVSS score of 5.3 and no publicly documented exploits, the likelihood of remote exploitation appears low; however, the vulnerability still permits local or internal attackers to corrupt memory by feeding crafted XML files to a running instance of Magick, potentially elevating privileges or causing denial of service. The lack of EPSS data and its absence from CISA's KEV catalog suggest limited exploitation activity, yet the known severity warrants prompt remediation.