ImageMagick’s viff encoder on 32‑bit builds contains an integer overflow that can cause a wraparound in a heap allocation. When a crafted viff file is processed, the overflow produces an out‑of‑bounds write that corrupts heap memory, causing the ImageMagick process to crash. The resulting loss of service is the primary impact of this flaw.

The issue affects all releases of ImageMagick older than 7.1.2‑19 and 6.9.13‑44 on 32‑bit platforms. It is limited to the viff encoder component and does not impact 64‑bit builds or later versions of the software.

With a CVSS score of 5.9, the vulnerability is considered moderate. No EPSS score is available, and it is not listed in the CISA KEV catalog, indicating limited known exploitation. Exploitation would require delivery of a specially crafted viff file to a system that processes untrusted images. The attack surface is therefore confined to environments that accept external image input, and the typical exploitation outcome is a crash rather than code execution or data theft.