Technical impact
The vulnerability in ImageMagick’s UHDR decoder allows an attacker to bypass configured width and height limits by embedding oversized dimensions in crafted UHDR images. Because the policy checks occur after decoding, the image data is fully processed before limits are enforced, resulting in excessive memory and CPU usage. This flaw is a resource exhaustion weakness (CWE‑400, CWE‑770) that can enable a denial‑of‑service attack against any service that accepts UHDR images for processing.
Affected Systems
All installations of ImageMagick earlier than 7.1.2‑33 are affected, including the standard ImageMagick distribution from the upstream project. The issue applies to every release prior to 7.1.2‑33 across all operating systems that ship ImageMagick.
Risk and Exploitability
The CVSS score of 6.9 places this flaw in the medium severity range, and the EPSS score is not available. Because the vulnerability can be triggered by supplying a single crafted UHDR file, the attack vector is likely remote if the image is processed by a network‑exposed application. The exploit does not require elevated privileges or code execution; it merely consumes resources to force an application to become unresponsive or crash, which is why the flaw is not listed in the CISA KEV catalog. Overall, the risk is moderate, but organizations that rely on image processing should monitor for unexpected resource usage.
