The vulnerability arises from a missing limit check in ImageMagick's MVG decoder. A crafted MVG image can cause the decoder to perform an excessively long operation, leading to a denial‑of‑service. This deficiency manifests as an uncontrolled resource consumption flaw (CWE‑400), insufficient input validation (CWE‑606), and a memory allocation flaw with excessive size (CWE‑770).

ImageMagick software versions earlier than 7.1.2‑31 and 6.9.13‑56 are susceptible. The issue affects the ImageMagick product supplied by the ImageMagick organization.

A CVSS score of 5.3 denotes moderate severity. The EPSS score of <1% indicates a very low exploitation probability, and the vulnerability is not listed in the CISA KEV catalog, suggesting no known widespread exploitation. The potential attack vector is inferred as remote or local based on the ability of an attacker to supply a malicious MVG file to any process that performs image decoding, such as web services or desktop editors.