The vulnerability resides in the CALS decoder of ImageMagick, where a missing recursion‑depth check allows a crafted CALS image to exhaust the process call stack and abruptly terminate the program. This leads to a denial of service on the affected system, as legitimate image processing requests continue to fail until the process restarts. The weakness is classified as CWE‑674 and CWE‑770, reflecting improper recursion depth management and resource exhaustion. Only the process termination effect is documented; no data leakage or elevation is reported.

ImageMagick, version earlier than 7.1.2‑30 for the main distribution and earlier than 6.9.13‑55 for the legacy package, is affected. All installations using the CALS image format decoder before these releases must be patched. No other vendors or product lines are listed.

The CVSS score is 5.3, indicating a moderate risk level. EPSS data is not available, so the probability of exploitation cannot be quantified. The vulnerability is not listed in the CISA KEV catalog. This flaw maps to CWE‑674 and CWE‑770, the missing depth check leading to stack exhaustion and resource exhaustion. Attackers can potentially exploit the flaw by supplying a malformed CALS image to any service or user process that invokes the ImageMagick decoder; the attack likely requires the ability to influence input fed to the decoder. The lacking depth check is the sole condition needed to trigger the crash, making the vulnerability straightforward to exploit if a vulnerable image is processed.