A heap-based buffer overflow in ImageMagick prior to version 7.1.2-15 poses a risk of application crashes or potential remote code execution for systems processing untrusted image files.

The vulnerability resides in the WriteUHDRImage function within coders/uhdr.c, where integer arithmetic used to calculate pixel buffer size is susceptible to an overflow. This flaw, which can be triggered by an unauthenticated attacker, results in an undersized heap allocation followed by an out-of-bounds write.

The vulnerability carries a CVSS score of 8.2, reflecting a high potential for service disruption and memory corruption. Successful exploitation could lead to significant system downtime if the ImageMagick process is used in critical automated workflows, and it may provide a vector for further system compromise through memory manipulation.

Immediate Action: Update ImageMagick to version 7.1.2-15 or later, or apply the corresponding updates for downstream packages such as Magick.NET version 14.10.3.

Proactive Monitoring: Monitor system logs for repeated process crashes or anomalous memory usage spikes occurring during image processing tasks.

Compensating Controls: Implement strict input validation and sanitization for all user-supplied images before they are passed to the ImageMagick library for processing.

Public Exploit Available: Unknown.

Given the potential for process instability and memory-based attacks, organizations should prioritize patching ImageMagick to the specified fixed versions. Administrators must ensure that all dependencies and language-specific wrappers are also updated to incorporate the upstream fix, effectively neutralizing the risk of heap-based memory corruption.