The flaw arises from a missing depth check in ImageMagick's fx operation. A crafted argument can trigger a stack overflow, potentially corrupting memory. The resulting memory corruption could lead to an application crash or, in some contexts, arbitrary code execution if the overwritten data controls execution flow. The weakness is classified as CWE‑120: Buffer Overflow and CWE‑674: Integer or Buffer Overflow.

ImageMagick software, version 7.x prior to 7.1.2-23. The patch was released in version 7.1.2-23.

The CVSS score of 6.2 indicates a moderate risk. The EPSS score is less than 1%, suggesting a low probability that this vulnerability will be actively exploited in the near term. This vulnerability is not listed in the CISA KEV catalog. Exploitation would likely require the attacker to supply a malicious image to a system running an unpatched ImageMagick instance. Because the flaw resides in a stack‑based buffer, the attack vector is inferred to be local or through a remote service that processes images without proper input validation.