A heap buffer overflow vulnerability in ImageMagick poses a risk of application crashes or potential memory corruption when processing malicious image files.

This vulnerability involves a heap-based buffer overflow (CWE-122) and an out-of-bounds write (CWE-787) within the MVG decoder. The flaw is exploitable by an unauthenticated attacker who provides a specially crafted image file to the application.

The vulnerability carries a CVSS score of 7.5, indicating a high severity risk primarily due to the potential for service disruption. Successful exploitation could lead to application instability or denial of service, which may impact business operations that rely on image processing workflows. While the current impact is focused on availability, memory corruption flaws can occasionally be leveraged for further system exploitation.

Immediate Action: Update ImageMagick to version 7.1.2-19 or 6.9.13-44, or update the Magick.NET NuGet packages to version 14.12.0.

Proactive Monitoring: Monitor application logs for unexpected crashes or error messages related to image decoding processes.

Compensating Controls: Implement input validation or sanitization routines for all user-uploaded images to ensure they conform to expected formats before processing.

Public Exploit Available: Unknown

Given the potential for service disruption and the nature of the buffer overflow, it is recommended that all systems utilizing ImageMagick be updated to the patched versions immediately. Organizations should prioritize patching in environments where image processing is exposed to external, untrusted input.