A crafted XMP profile embedded in an image can cause the ImageMagick profile parser to enter an infinite loop, preventing image processing from completing. This flaw is classified as CWE-835 and results in a denial of service that can exhaust processing resources or lock up services that rely on ImageMagick. The vulnerability does not provide remote code execution or data exfiltration capabilities; it primarily disrupts availability of image handling functions.

The issue affects the ImageMagick library, versions prior to 7.1.2-32 and 6.9.13-57. Any system that uses these older releases to process images – such as web servers, content management systems, or media workflows – is potentially impacted.

The CVSS score of 5.3 indicates moderate severity. There is no EPSS data available, and the vulnerability is not listed in the CISA KEV catalog, suggesting no confirmed exploitation to date. Attackers would need to supply a malicious image containing the crafted XMP profile to a system that processes images. Consequently, the threat is limited to environments that accept untrusted image uploads or handle untrusted image files.