The JP2 encoder in ImageMagick versions prior to 7.1.2‑26 incorrectly processes arguments, causing a heap buffer over‑write that corrupts memory adjacent to the buffer. This memory corruption may lead to application crashes or other disruptive behaviours when a specially crafted JPEG‑2000 image is processed. The flaw is a classic buffer‑overflow (CWE‑787) and an argument handling error leading to unsafe memory usage (CWE‑682).

Any installation of ImageMagick 7.x below 7.1.2‑26 that processes JPEG‑2000 input is affected. This includes web servers, image conversion services, or any system component that calls the JP2 encoder directly or indirectly.

The CVSS score of 5.5 denotes medium severity, and the EPSS score of <1% indicates a low probability of exploitation in the wild. The vulnerability is not listed in CISA's KEV catalog. An attacker would need to supply a maliciously crafted JPEG‑2000 image to an ImageMagick process, which could be local or remote if the application accepts untrusted images. Successful exploitation would result in unpredictable behaviour such as crashes or potential denial‑of‑service.