A heap buffer over‑write vulnerability exists in ImageMagick’s distributed pixel cache server. When an attacker connects to the magick -distribute‑cache service, the server can overwrite memory beyond the bounds of a heap buffer, potentially corrupting application state or causing a crash. This flaw can lead to data loss or a denial‑of‑service condition, and if exploited further could open a path to arbitrary code execution, though the CVE data does not explicitly confirm that capability.

The vulnerability affects ImageMagick releases prior to version 6.9.13‑48 and 7.1.2‑23. Systems running these earlier releases of ImageMagick and exposing the distributed pixel cache service are at risk. Upgrading to at least 6.9.13‑48 or 7.1.2‑23 mitigates the flaw.

The CVSS score of 4.1 indicates moderate risk; no EPSS score is available, and the issue is not listed in CISA’s KEV catalog. An attacker can remotely connect to the distributed pixel cache service—an inference from the description—to trigger the heap over‑write. Because the flaw requires network access to the service, protecting that interface reduces exploit likelihood, but the lack of a higher severity score suggests that the impact, while present, is not catastrophic without additional compromise steps.