ImageMagick versions prior to 7.1.2-26 and 6.9.13-51 contain a flaw in the ICON decoder that triggers a memory leak when a memory allocation fails. If a crafted Icon file is processed, repeated allocation failures leak memory, potentially exhausting system resources and rendering the processing tool or any application that uses the library unavailable. The underlying weakness is an uncontrolled memory allocation (CWE-401) and improper handling of an allocation failure (CWE-772).

The vulnerability affects installations of the ImageMagick image processing suite that are older than version 7.1.2-26 or 6.9.13-51. All users of pre‑release releases before these updates are potentially impacted.

The CVSS base score of 6.3 indicates moderate severity, while an EPSS score of less than 1% shows a very low predicted exploitation probability. The issue is not listed in the CISA KEV catalog. Exploitation requires an attacker to supply a crafted Icon file to the ImageMagick library, either by invoking the command‑line tools directly or by embedding the file in an application that calls the library. Because this is a memory‑leak flaw rather than a code‑execution flaw, the primary impact is on system or application availability rather than confidentiality or integrity.