ImageMagick’s JP2 encoder performs a heap out‑of‑bounds write when a user supplies an invalid sampling index. This memory corruption can lead to a denial of service and, if the ImageMagick instance runs with elevated privileges, it could potentially allow escalation of privileges or code execution. The vulnerability is a classic heap buffer overflow identified as CWE‑122 and CWE‑787.

All ImageMagick releases earlier than 7.1.2‑19 and 6.9.13‑44 are affected. Any application that incorporates these releases, including language bindings such as Magick.NET, must be updated. The fix is included in ImageMagick 7.1.2‑19 and 6.9.13‑44 and corresponding packages released after those version numbers.

The CVSS score of 5.5 indicates medium severity. Because EPSS data is not available and the vulnerability is not listed in the CISA KEV catalogue, the likelihood of exploitation appears low at present. Attackers would need to supply a crafted JP2 file that contains an invalid sampling index; the impact depends on the privilege level of the process using ImageMagick. No public exploits have been reported, so the primary risk is denial of service, with a potential for higher‑level compromise if elevated privileges are present.