The flaw in ImageMagick’s JNG decoder causes temporary files to remain undeleted when aNG file is processed. An attacker who can submit such files to the image‑processing workflow can repeatedly trigger the creation of temporary files, gradually consuming the file system’s available disk space and ultimately rendering the system unable to write or execute further processes. The vulnerability is classified as an improper cleanup weakness (CWE‑459).

ImageMagick versions earlier than 6.9.13‑57 and 7.x prior to 7.1.2‑32 are affected. These include all distributions of the ImageMagick image‑processing library that expose the JNG decoder functionality. Users running these older releases should verify their installed version and identify any use of the JNG decoding path.

The CVSS score of 6.9 indicates a medium severity risk. Because the exploit requires only the ability to submit a specially crafted JNG file, it can be performed from an external network if the ImageMagick instance is exposed to untrusted input. The EPSS score is not available, and the issue is not listed in CISA’s KEV catalog, but the denial‑of‑service potential means the vulnerability can severely degrade availability in a timely manner once activated.