Memory is leaked when the ImageMagick CLI receives malformed command‑line arguments, causing the tool to allocate resources that are never freed. The leakage can be repeated, cumulatively exhausting the host’s memory pool and potentially crashing the process or the system. The flaw illustrates a CWE‑401 Memory Management: Resource Leak weakness that directly undermines availability by allowing an attacker to deplete service resources.

Any host running ImageMagick before release 7.1.2‑27, regardless of operating system, is vulnerable when the command‑line tool "magick" is invoked with arbitrary or malformed options. Users or scripts that pass unvalidated parameters to magick are at risk.

The vulnerability has a CVSS score of 4.8, indicating moderate severity, and an EPSS score of less than 1 %, suggesting that exploitation is unlikely but not impossible. It is not listed in the CISA KEV catalog. The CVE description indicates that the vulnerability is triggered by providing malformed command‑line arguments to the magick tool; the attack vector is not explicitly remote but requires the ability to invoke the tool with such arguments. By repeatedly supplying invalid options, an attacker can potentially exhaust system memory and cause denial of service.