An integer conversion error in the PSD decoder of ImageMagick causes the parser to enter an endless loop when processing specially crafted Photoshop files on 32‑bit builds. The loop exhausts CPU resources and results in a denial of service to the application or system that loaded the image. This weakness maps to CWE‑196 for improper data conversion and CWE‑835 for infinite loops.

32‑bit installations of ImageMagick prior to release 7.1.2‑32 and 6.9.13‑57 are vulnerable; the flaw is confined to the PSD decoder and does not affect other formats or 64‑bit builds.

The CVSS score of 5.9 indicates medium severity. No EPSS value is published, so exploitation likelihood is not quantifiable, and the issue is not listed in CISA’s KEV catalog. Attackers can trigger the bug by delivering a malicious PSD file to any image‑processing pipeline that accepts user‑supplied images—typical vectors include web servers, CMSs, or services that load images from external sources. Because the flaw does not permit code execution or privilege escalation, its impact is limited to service disruption, though in mission‑critical environments it could facilitate further denial‑of‑service attacks.