ImageMagick contains a heap buffer overflow in its JXL encoder when an image is encoded as 16‑bit float. The flaw can corrupt memory in the process and, if an attacker can control the encoding call, could enable arbitrary code execution or cause a denial of service by crashing the application. The vulnerability represents a moderate risk to the integrity of any system that processes untrusted images using this feature.

The issue is present in all ImageMagick releases prior to 7.1.2‑19. Users running any older version of the ImageMagick product are potentially affected; upgrading to 7.1.2‑19 or a later release removes the flaw.

The CVSS score of 5.5 indicates medium severity. No EPSS data or KEV listing is available, implying limited public evidence of exploitation. Exploitation would require the JXL encoder to be invoked with the 16‑bit float option, suggesting an attack vector that relies on maliciously crafted image data processed by an application that performs such encoding. Full exploitation would likely need additional weaknesses in the surrounding environment, but the presence of a heap overflow raises concern for trusted environments or those handling unverified input.