A crafted Magick script can leave an opened file pointer unclosed during processing, causing ImageMagick to consume file descriptors with each run. Repeated executions eventually exhaust the system's available descriptors, leading to resource exhaustion that manifests as a denial of service for the user or the application that relies on ImageMagick. The weakness is captured by CWE-772 and CWE-775.

The issue affects installations of ImageMagick 7.1.x prior to version 7.1.2‑31 on any platform where Magick scripts are executed. It is present in the core ImageMagick component distributed as ImageMagick:ImageMagick.

The CVSS score of 5.3 indicates moderate risk. EPSS data is not available, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is a local user or a process that can supply a malicious Magick script; if the service running ImageMagick has elevated privileges or the script is processed automatically, the impact could affect system availability. Exploitation requires the attacker to trigger repeated processing to deplete file descriptors, which may require persistence or repeated input.