ImageMagick’s ICON decoder contains an incorrectly constructed loop that allows a crafted icon file to write beyond the bounds of a heap buffer. This heap overflow can corrupt memory and cause the process to crash. The current description indicates the impact is a denial of service; while the overflow could in theory lead to code execution if the memory overwrite is exploited further, no such weakness is confirmed in the advisory.

Vendors and products affected include ImageMagick. Any installation of ImageMagick prior to version 6.9.13‑50 or 7.1.2‑25 is vulnerable. The vendor has released patches for these versions and later releases.

The CVSS score of 7.5 reflects a high severity level. No EPSS score is available and the issue is not listed in the CISA KEV catalog, suggesting it has not yet been widely exploited. Attackers would need to supply a malicious ICON file to the vulnerable decoder, which is feasible in web or desktop applications that process user-supplied images. Because the vulnerability lies in a non-privileged component, it results primarily in local denial of service rather than privilege escalation or remote code execution at this time.