ImageMagick contains a heap buffer over‑write that occurs during the morphology operation when it receives an invalid kernel generated from user supplied data. The overflow corrupts heap memory and can trigger an application crash or other unintended behaviour. The weakness falls under CWE‑805 (Buffer Access with Incorrect Length Value) and CWE‑190 (Integer Overflow or Division by Zero).

All installations of ImageMagick older than 6.9.13‑51 and 7.1.2‑26—including every release in the 7.0.x series—are affected. Applications that invoke the morphology function with kernel values supplied by external users, such as web services that process uploaded images, would be vulnerable if no protective checks are in place.

The CVSS score of 4.7 indicates a moderate risk; exploitation is local to the context that processes the malformed image. The EPSS score of < 1 % implies a very low probability of widespread exploitation. The vulnerability is not listed in CISA’s KEV catalog. Attackers would need to supply crafted image data containing an unsupported kernel value, making the attack vector user‑controlled image input; systems that only process trusted or validated images face reduced exposure.