The vulnerability is a memory leak in ImageMagick’s META reader when processing APP1JPEG image headers. An attacker can provide a specially crafted APP1JPEG file that causes memory to be allocated and never released, leading to a gradual increase in memory consumption and eventual exhaustion of system resources. The flaw corresponds to CWE-401 (Improper Release of Memory) and CWE-772 (Missing Release of Memory after Effective Lifetime). The result is a denial‑of‑service condition that can affect any process using ImageMagick when it parses such input.

Any deployment of ImageMagick that contains the vulnerable META reader code and processes APP1JPEG image paths is potentially impacted. This includes any system that accepts external image uploads, email attachments, or other input mechanisms that trigger ImageMagick’s image‑processing libraries if the installed version predates the fix. The exact affected releases are those before 7.1.2‑18, as noted in the advisory, but the specific versions are not publicly listed in the CVE payload.

The CVSS score of 4.8 indicates moderate severity. The EPSS score of < 1 % reflects a very low likelihood of exploitation in the wild, and the vulnerability is not listed in the CISA KEV catalog. The attack path is inferred to be remote; an adversary only needs to deliver a malicious image that will be processed by ImageMagick. No authentication is required for the code path, and the leak can accumulate across successive image processing calls.