ImageMagick versions older than 6.9.13-57 and 7.x older than 7.1.2-32 contain a stack overflow in the MSL decoder caused by an unchecked depth check that fails to limit recursion. When an attacker supplies a crafted MSL image, the decoder can exhaust the call stack, causing the process that performed the decoding to crash. This results in a denial of service by terminating the affected application or daemon without granting the attacker any additional privileges.

The vulnerability affects the ImageMagick software suite, specifically versions prior to 6.9.13-57 in the 6.x series and prior to 7.1.2-32 in the 7.x series. Users deploying any of these older ImageMagick releases are susceptible to the described stack overflow when processing MSL images.

The CVSS score of 6.9 indicates a moderate severity. Because the exploit requires the attacker to provide a malformed image to an ImageMagick instance, the attack vector is likely local or through a remote channel that can supply images to the target application. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting no publicly known widespread exploitation. Nevertheless, the lack of a mitigation beyond preventing image processing means an attacker can reliably cause a service interruption by repeatedly delivering malicious MSL files.