ImageMagick versions prior to 7.1.2-26 contain a heap use‑after‑free flaw caused by a missing null check when parsing XMP profiles. This issue exemplifies CWE-476 (null pointer dereference) and CWE-252 (unchecked return value). A crafted XMP payload can trigger the bug, leading the image‑processing engine to crash and terminate the process. The vulnerability does not expose data or allow code execution, but it can be used to disrupt availability of services that rely on ImageMagick for image handling.

The affected vendor is ImageMagick; product ImageMagick. All installations running any version earlier than 7.1.2-26 are potentially impacted. Updated releases beginning with 7.1.2-26 contain the fix.

The CVSS score of 6.3 indicates a moderate severity, and the EPSS score is <1%, indicating a very low probability of exploitation. The flaw is not listed in the CISA KEV catalog. Because the description mentions the manipulation of an image file, the likely attack vector is through files that an application accepts for processing—either a local file upload or remote image download. Exploitation would simply crash the image‑processing process, possibly causing a denial of service to a web application, media server, or other service that relies on ImageMagick.