Technical impact
ImageMagick before releases 6.9.13-58 and 7.1.2-33 contains a policy bypass in the PS, PDF and XPS decoders that allows an attacker to supply a crafted argument to cause the program to process more scenes than the security policy permits. This circumvention can lead to excessive CPU and memory usage, potentially resulting in a denial‑of‑service condition. The weakness is identified as CWE-770, indicating improper resource usage.
Affected Systems
Affected products are ImageMagick software from the ImageMagick vendor. The vulnerability applies to all versions prior to 6.9.13-58 and prior to 7.1.2-33. These versions lack the policy enforcement that limits scene selection during decoding.
Risk and Exploitability
The CVSS score of 4.8 classifies the issue as moderate severity, and the EPSS score is not available, so the current exploitation likelihood is uncertain. The vulnerability is not listed in the CISA KEV catalog. While the discovery report does not specify the exact attack vector, it is inferred that an attacker could provide a malicious image file or command‑line argument to trigger the bypass, suggesting a local or remote file‑processing vector that requires the application to run with elevated privileges or on untrusted data.
Debian DLA