The vulnerability allows an unauthenticated adjacent‑network client to repeatedly connect to the distributed pixel cache server in ImageMagick. Each connection consumes a slot in the server’s connection pool. Over time, an attacker can exhaust all available connections, causing the server to refuse new images and effectively creating a denial of service. This weakness is classified as CWE‑400 and CWE‑770 and results in loss of service for any application that relies on the pixel cache network component.

ImageMagick, version 7.1.2-32 is the fixed release. All earlier releases before 7.1.2-32 are vulnerable. The issue affects installations that enable the distributed pixel cache server and are reachable from adjacent networks.

The CVSS score is 4.3, indicating moderate impact. Because the EPSS score is not provided, the current exploitation probability is unknown, but the vulnerability is not listed in the CISA KEV catalog. The attack can be performed from any host on the same network that can reach the distributed pixel cache port; no authentication is required. An attacker could repeatedly open connections until the server is saturated, leading to a denial of service for other legitimate users.