A stack buffer overflow in the XTileImage component of ImageMagick can be triggered by opening a specially crafted MIFF file in the display tool and then right‑clicking a tile to invoke the Load / Update menu. The flaw is a stack buffer overflow (CWE‑121) that also involves uninitialized memory usage (CWE‑131). The overflow leads to a crash of the application. The vulnerability is scored at 5.5 on the CVSS scale, indicating a moderate impact.

ImageMagick versions older than 7.1.2‑21 and 6.9.13‑46 are vulnerable. This includes all releases of the 7.x series before 7.1.2‑21 and all releases of the 6.x series before 6.9.13‑46. Users of the free and open‑source ImageMagick product who run the display utility are potentially affected.

The CVSS score of 5.5 reflects the local nature of this flaw: an attacker must deliver a malicious MIFF file and have the victim open it in the display tool, then perform a specific user action. No remote exploitation vector is documented, and the EPSS score, recorded as 0.00014 (<1%), indicates a very low exploitation probability. The vulnerability is not listed in CISA’s KEV catalog. Immediate patching mitigates the risk entirely.