ImageMagick is a widely used open‑source image editing library. Prior to version 7.1.2‑25 invalid options passed to its wand option parser trigger a small memory leak. A memory leak can lead to gradual exhaustion of system resources, potentially causing a denial of service if an attacker repeatedly submits bad arguments. The weakness is identified as CWE‑401, unchecked or improperly handled memory leakage, and CWE‑772, missing release of memory after its effective lifetime.

Vendors and products: ImageMagick ImageMagick. Affected versions are all releases older than 7.1.2‑25; the patch was applied in 7.1.2‑25. No specific sub‑product versions other than the major version are listed.

The CVSS score of 4.0 indicates moderate severity, suggesting that while the vulnerability is not high‑impact, repeated exploitation can degrade system performance. The EPSS score of 0.013% indicates a very low but non‑zero probability of exploitation. It is not listed in the CISA KEV catalog. Inference: the attack vector would involve supplying crafted wand options to a running ImageMagick instance, which is commonly performed during image processing by web applications, or via a standalone command line invocation. The legitimate use of ImageMagick may make it easier for attackers to trigger the bug if a vulnerable process is exposed.