This flaw occurs during image decoding in the MolotovCherry Android-ImageMagick7 library. A specially crafted image triggers an out-of-bounds write, overwriting nearby memory. The damage range includes corrupted internal data structures, unexpected termination, or, if an attacker can control the overwritten data, execution of malicious code. The description lists it as a memory corruption with the risk of arbitrary code execution, but no explicit exploit is provided.

The affected product is the MolotovCherry Android-ImageMagick7 library in all releases prior to 7.1.2-11. Any Android application or service that incorporates this library and processes externally supplied images may be vulnerable. No other components of the Android platform are affected.

The CVSS base score of 7.8 indicates a high severity vulnerability. The EPSS score is below 1%, suggesting that publicly available exploits are unlikely at present. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is the delivery of a maliciously crafted image processed by the library, as inferred from the nature of the flaw in an image-processing routine.