ImageMagick before 7.1.2-32 contains a memory leak in the -process option. When certain arguments are supplied, it fails to release memory that has been allocated during processing. An attacker can repeatedly invoke the option with crafted input, causing the program to consume more and more memory until the process is terminated or the system runs out of resources, thereby degrading service availability.

The vulnerability affects the ImageMagick software from the ImageMagick vendor. All releases prior to version 7.1.2-32 are susceptible; versions 7.1.2-32 and later contain a fix.

The CVSS score is 4.8, indicating a moderate impact. EPSS information is not available and the vulnerability is not listed in the CISA KEV catalog. Because exhaustion depends on repeated processing of crafted input, the likely attack vector is remote or local code that invokes ImageMagick with the -process option on untrusted data. No public exploit is known, but the risk of a denial of service remains if the option can be exercised repeatedly.