ImageMagick prior to 7.1.2-13 has a memory leak in LoadOpenCLDeviceBenchmark() when it parses malformed OpenCL device profile XML files that lack a closing device element. The improper release of memory resources can cause the application to consume increasing amounts of RAM, eventually exhausting system memory and forcing the process to terminate or fail to start new operations, which manifests as a denial of service. This vulnerability falls under CWE‑401, a classic use‑after‑free or memory leak weakness.

Any installation of ImageMagick that has not been upgraded beyond version 7.1.2‑13 is potentially vulnerable. The issue affects the core library across all platforms where ImageMagick is used to process OpenCL device profiles, regardless of operating system. Systems running or exposing ImageMagick with writeable OpenCL cache directories are required to apply the update or mitigation.

The exploitability of this flaw is limited to environments where an attacker can write files into the OpenCL cache directory. If such write access is granted, an attacker may place a crafted XML file that triggers the memory leak, leading to gradual depletion of available memory and a denial‑of‑service condition. The CVSS score of 1.8 indicates low technical severity, and no exploitation has been reported in the KEV catalog or via publicly available release channels. Nonetheless, because the attack requires local write privileges, the risk remains real for systems that expose the cache directory to untrusted users.