Prior to version 7.1.2-25, the SF3 encoder in ImageMagick can overwrite heap memory when processing a crafted multi‑frame image. This buffer over‑write is a classic heap corruption vulnerability (CWE‑122, CWE‑787) that may allow an attacker to execute arbitrary code or cause a denial of service through a crash, depending on the privileges of the image processing context.

The vulnerability affects all releases of the ImageMagick image processing library before version 7.1.2‑25. Users running older versions of the library are potentially exposed.

The CVSS score of 6.2 indicates moderate severity. No EPSS score is currently available, and the vulnerability is not listed in the CISA KEV catalog. Attackers would likely need to supply a malicious multi‑frame image to an application that uses the SF3 encoder; the vector is therefore considered local or application‑based. While the description does not confirm an exploit, the nature of the overflow makes arbitrary memory overwrite possible, warranting precaution.