The vulnerability is a negative heap buffer underwrite that occurs when ImageMagick processes an image with a mask using the Floyd‑Steinberg dithering method. The underwrite can corrupt adjacent heap memory, potentially causing crashes, data corruption, or, in the presence of exploitable code, arbitrary code execution. It is listed under CWE‑787 and is mitigated in version 7.1.2‑24.

The vulnerability affects ImageMagick by ImageMagick. Any installation older than version 7.1.2‑24 that uses Floyd‑Steinberg dithering on masked images is susceptible. Versions 7.1.2‑24 and later contain the patch.

The CVSS score of 5.5 gives it a medium severity. No EPSS score is available, and the issue is not listed in CISA KEV. Likely attack vector involves a crafted image file that the software processes; the vulnerability could be exploited locally by an attacker who can supply such a file, or remotely if the image is handled in a publicly exposed service. No evidence of active exploitation is public.