ImageMagick prior to version 7.1.2‑15 is vulnerable to a use‑after‑free condition within its PDB decoder. When a memory allocation fails, the decoder uses a stale pointer and writes to freed memory, which can result in an application crash or the writing of a single zero byte to memory that has already been released. The primary impact is memory corruption that can lead to a denial‑of‑service or to unintended modification of data if the corrupted memory region is subsequently read or used.

The flaw affects all installations of ImageMagick older than 7.1.2‑15. No platform dependencies are specified beyond the general ImageMagick suite. Users who run the vulnerable versions on any operating system, including Linux, macOS, or Windows, are potentially affected. The vulnerability applies to every product that includes the PDB decoding functionality as standard in releases before the patch.

With a CVSS score of 6.3 the weakness sits in the medium‑to‑high range, while the EPSS score being below 1 % indicates a very low likelihood of attack at the time of analysis. The vulnerability is not listed in the CISA KEV catalog, suggesting it is not currently exploited in the wild. Based on the description, it is inferred that the most probable attack vector involves an attacker supplying a crafted PDB file to an ImageMagick instance that processes untrusted input, such as a web application rendering images, an email server processing attachments, or any service that ingests‑supplied pictures. If the attacker can influence the processing path, they can trigger the use‑after‑free and cause a crash or corrupt a small portion of memory.