ImageMagick, a widely used image processing library, contains a flaw that allows a crafted XMP profile to cause the parser to perform excessive calculations when resolving rational numbers. The result is an uncontrolled increase in processing time, leading to a denial of service. The weakness is identified as CWE-400 (Insufficient Resource Limits) and CWE-834 (Unbounded Resource Allocation). The attack compromises the availability of any service that relies on ImageMagick to handle untrusted images, potentially rendering web content delivery or media processing unavailable.

All installations of ImageMagick that are older than version 7.1.2-31 are vulnerable. The issue applies wherever the ImageMagick library parses XMP metadata from images. Users of legacy builds of the library used in web servers, content management systems, or desktop applications should check their current version and update if necessary.

The CVSS score of 5.3 indicates a moderate threat level. No EPSS data is available, and the vulnerability is not listed in CISA KEV. The likely attack vector is remote, as an attacker could embed a malicious XMP profile in an image that is processed by a vulnerable service. If the application accepts images from external sources, the denial of service can be triggered without local privileges. Absent any specific workaround, the risk persists until the library is updated to 7.1.2-31 or later.