ImageMagick’s DecodeImage() function enters an infinite loop when a PCD file lacks a valid Sync marker. The loop consumes CPU, causes the program to hang, and eventually exhausts system resources, disabling the image processing service. This flaw is a classic denial‑of‑service vulnerability stemming from insufficient input validation (CWE‑400) and an unbounded loop (CWE‑835).

The vulnerability affects ImageMagick prior to releases 7.1.2‑15 and 6.9.13‑40. Versions following those releases include the patch. The CPE list also lists magick.net, indicating that the .NET binding may use the same decoding code; however, the CVE description does not explicitly mention Magick.NET versions, so its impact remains inferred.

With a CVSS score of 7.5, the flaw represents high impact. The EPSS score is reported below 1 %, suggesting a low but non‑zero likelihood of observed exploitation. The vulnerability is not listed in the CISA KEV catalog. Exploitation would require feeding a crafted PCD file to an application that invokes ImageMagick’s DecodeImage routine, which could be done remotely if the application accepts user‑supplied image files. Because the flaw causes resource exhaustion rather than privilege escalation, an attacker would need only the ability to input the malicious file.