The flaw is a null pointer dereference that occurs in the distort operation when an image is processed with incorrect arguments. The bug causes ImageMagick to crash and potentially stop a service, resulting in a denial of service. The weakness is identified as CWE‑476.

Vulnerable versions of ImageMagick include all releases prior to 6.9.13‑50 and prior to 7.1.2‑25. These affected branches include ImageMagick v6 series before 6.9.13‑50 and ImageMagick v7 series before 7.1.2‑25. Systems that run these older releases and invoke the distort operation are at risk.

The recorded CVSS score is 4.3, indicating moderate severity. No EPSS score is available, so the likelihood of exploitation is uncertain, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is a crafted image file that a service using ImageMagick will process; by supplying malformed distort parameters a local or remote user could trigger the crash.