The vulnerability resides in the ExtractPostscript function within the GraphicsMagick WPG file handler. When a crafted WPG file is processed, the function can enter an uncontrolled recursion loop, potentially exhausting stack memory or leading to a crash. This deficiency can be leveraged by a remote attacker to cause a denial‑of‑service condition on the affected system. The weakness corresponds to CWE‑674 and CWE‑404, reflecting improper handling of input data that drives the recursion.

GraphicsMagick versions up to and including 1.3.47 are affected. The issue appears in the wpg.c component of the WPG file handler. Systems that use older GraphicsMagick releases and accept untrusted WPG files should consider the risk. A patch (commit 627b5b1b2fc2) has been released to fix the recursion problem.

The CVSS score of 5.3 indicates a medium severity. EPSS information is not available, and the vulnerability is not yet listed in CISA KEV catalog. Although the attack vector is reported as remote, the exact conditions—for example, required privileges or network exposure—are not detailed, meaning that if a system processes WPG files from an external source, the risk remains. Due to the medium score and lack of exploit data, the likelihood of exploitation appears low but should not be dismissed, especially in environments where WPG files are routinely handled.