An out-of-bounds heap write occurs when ImageMagick processes multiple image files of different dimensions in a single read operation, allowing a malicious user to overwrite arbitrary memory. The vulnerability is a classic buffer overflow (CWE-122, CWE-787) and can lead to image processing crashes, denial of service, or potentially arbitrary code execution if the attacker controls the image data. The impact is widespread because any system that accepts untrusted images for conversion or manipulation is at risk.

The flaw exists in the ImageMagick suite for all versions released prior to 6.9.13-48 and 7.1.2-23. Any deployment using those older releases and performing multi‑image reads with variable dimensions is vulnerable. The patch is released in the mentioned newer versions, which correct the heap bounds checking when decoding IPL data.

With a CVSS score of 7.5 the vulnerability is considered high severity. No EPSS score is available, but the lack of Kinetic Exploitation Vulnerabilities reporting suggests no widespread active exploitation is documented yet. However, because attackers can supply crafted image files, the likely attack vector is a supply‑chain or web‑based vector where untrusted images are processed. The risk remains substantial for any environment that uses ImageMagick on untrusted input.