Technical impact
ImageMagick before version 7.1.2‑15 is vulnerable to a use‑after‑free condition in its PDB decoder. When a memory allocation fails, the decoder dereferences a stale pointer and writes a single zero byte to memory that has already been freed, which can cause an application crash or corrupt a small area of memory. The primary impact is memory corruption that can lead to a denial of service or unintended data modification if the corrupted region is subsequently accessed.
Affected Systems
The flaw affects all installations of ImageMagick older than 7.1.2‑15 across all supported platforms, including Linux, macOS, and Windows. Any product or service that incorporates the PDB decoding functionality provided by these older releases is potentially vulnerable.
Risk and Exploitability
With a CVSS score of 6.3 the weakness sits in the medium‑to‑high range, while the EPSS score of less than 1 % indicates a very low likelihood of exploitation at the time of analysis. The vulnerability is not listed in the CISA KEV catalog, suggesting it is not presently exploited in the wild. It is inferred that the most probable attack vector involves an attacker supplying a crafted PDB file to an ImageMagick instance that processes untrusted input—such as a web application rendering images, an email server handling attachments, or any service that ingests pictures—thereby triggering the use‑after‑free and causing a crash or modest memory corruption.
Debian DLA
Ubuntu USN