ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains uncontrolled recursion in the MVG decoder that can exhaust the program stack. The resulting stack overflow causes the process to crash, leading to a denial of service. This weakness is classified as CWE‑674, uncontrolled recursion, and CWE‑770, stack buffer overrun.

All deployments of ImageMagick using versions earlier than 6.9.13‑57 and 7.x earlier than 7.1.2‑32 are affected. The vulnerability is present regardless of platform, as the issue resides in the core MVG decoding functionality.

The attack vector requires the attacker to control a filename that ImageMagick will process. If the image comes from an untrusted source—such as user‑uploaded content processed by a web application—the attacker can trigger the stack overflow. The CVSS score of 6.3 indicates moderate severity. No EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog. The consequence is a loss of availability for the affected process, and in multi‑tenant or high‑availability environments, this could lead to broader service disruption.