The Android-ImageMagick7 library released by MolotovCherry contains an unchecked input validation flaw identified as CWE‑20. The flaw allows image data to be processed without proper validation of its contents. While the description does not specify the exact outcome of processing such data, the CVSS score of 9.8 indicates that a successful exploit could have a severe impact on the system where the library is used.

All builds of MolotovCherry Android-ImageMagick7 released prior to version 7.1.2‑11 are vulnerable. The library is typically integrated into mobile and embedded applications that require image handling functions, so any application including these earlier releases could be affected.

The CVSS score of 9.8 signals critical severity. The EPSS score is less than 1%, implying that the likelihood of widespread exploitation is low, and the vulnerability is not listed in the CISA KEV catalog. Likely exploitation would require the library to process malicious or malformed image data—an intentional or accidental input path—though no publicly disclosed exploitation techniques are available.