An attacker can craft a malicious ASE image that, when processed by ImageMagick, bypasses missing validation and resource checks. The parser may then crash or consume excessive time and memory, resulting in a denial of service. The weakness is a failure to properly control resource usage, as defined by CWE-770 and CWE-789. The impact is limited to service availability, with no direct compromise of confidentiality or integrity described.

ImageMagick, all versions prior to 7.1.2-32 are affected. Any deployment that processes untrusted ASE images using these older releases is vulnerable.

The CVSS score of 5.3 indicates moderate severity, reflecting a denial of service rather than catastrophic compromise. EPSS data is not available, so the likelihood estimate is unknown, and the CVE is not listed in the CISA KEV catalog. The vulnerability can be exploited by providing a crafted ASE image to any ImageMagick instance that accepts and processes ASE files, such as web servers, email gateways, or CI pipelines that transform images. There are no special prerequisites beyond the ability to submit or load an ASE image; the attack vector is likely local or remote depending on the service architecture.