The vulnerability is a memory leak in ImageMagick’s SVG encoder, WriteSVGImage, which fails to release memory when processing crafted SVG files. An attacker can supply a malicious image that, when encoded, slowly consumes system memory until the application or host cannot allocate further resources, resulting in a denial of service. The weaknesses are rooted in improper memory management (CWE-401) and incorrect resource handling (CWE-772).

Vulnerable versions of ImageMagick include releases before 6.9.13‑57 and all 7.x versions prior to 7.1.2‑32. Systems that rely on these libraries to process SVG or apply SVG encoding are at risk, particularly environments that accept or render untrusted images.

The CVSS score of 6.9 indicates moderate severity, with the impact limited to service disruption rather than confidentiality or integrity loss. The EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalogue, suggesting no widespread exploitation reports yet. Based on the description, it is inferred that the likely attack vector is an attacker supplying a crafted SVG file to the SVG encoder; the vector could be local if the application processes files from an attacker-controlled directory, or remote if the application accepts uploads. Exploitation is straightforward once a vulnerable version is in use, with no significant prerequisites beyond the ability to introduce the malicious image.