ImageMagick versions before 7.1.2-19 contain a flaw in the ConnectedComponentsImage() function. The function reads a connected‑components artifact that can specify an index outside the bounds of the allocated array. When an attacker supplies a malformed artifact through the command‑line interface, the library can read memory it should not access, triggering an access violation. The result is a denial of service but the read may also expose or alter data, creating a path to arbitrary code execution if the memory corruption is leveraged. The weakness is a classic out‑of‑bounds read (CWE‑125).

The vulnerability affects all installations of ImageMagick before release 7.1.2‑19. This includes every system that relies on the standard ImageMagick distribution, regardless of platform, as the flaw exists in the core library code.

The CVSS score is 4.8, indicating a moderate severity, and the EPSS score is not available, so the likelihood of widespread exploitation cannot be quantified from the data presented. The vulnerability is not listed in CISA's KEV catalog. Attackers would need to craft a specific connected‑components artifact and invoke ImageMagick with that input, typically through the command line. The absence of a public exploit suggests that exploitation requires environment preparation, but the denial of service impact remains useful for attackers seeking to degrade services.