ImageMagick prior to 6.9.13-55 and 7.x before 7.1.2-30 includes a flaw in the MAT decoder that fails to enforce configured temporary file size limits during decompression of highly compressed data. This weakness, identified as improper enforcement of policy (CWE-409), allows an attacker to supply a crafted MAT image whose decompressed content exceeds policy limits, resulting in large temporary files being written and consuming disk space. The primary consequence is resource exhaustion that can lead to application or system instability and denial of service.

The vulnerability affects ImageMagick installations running any version before 7.1.2-30 or before 6.9.13-55. Users running these older releases with the MAT decoder enabled are at risk.

The CVSS score of 6.9 indicates moderate severity, and the absence of an EPSS rating means a precise exploitation probability is not quantified. The vulnerability is listed as not being in the CISA KEV catalog. Even without a public exploit, the attack vector is inferred to be from a user who can supply input to the ImageMagick processing pipeline, such as through a web service that processes uploaded images. Once an attacker can deliver a crafted MAT file, the temporary file size bypass can be exercised, forcing the system to create and write very large files which may exhaust disk space or cause the image processing to fail.