ImageMagick, a widely used open‑source image manipulation library, contains a logic error in YUV sampling factor validation. An attacker can provide an image with an invalid sampling factor that bypasses internal checks, causing a division‑by‑zero during image loading. This error leads to a crash that reliably triggers a denial‑of‑service condition for the affected process. The weakness corresponds to CWE‑369.

Vendors: ImageMagick; Product: ImageMagick. Affected versions are all releases prior to 7.1.2‑15 and 6.9.13‑40.

The CVSS score of 5.3 indicates moderate severity, and the EPSS score of less than 1% shows a very low probability of exploitation in the wild. The vulnerability is not currently listed in the CISA KEV catalog. Exploitation requires an attacker to supply a crafted image to a vulnerable instance of ImageMagick, such as when an application automatically processes user‑supplied images. Because the denial‑of‑service outcome is deterministic, an attacker could deliberately bring the target process or host down if they have control over image input. The attack vector is therefore a remote or local image upload, depending on how the software is exposed.