The vulnerability is caused by missing limits in the internal SVG decoder of ImageMagick, which allows an attacker to craft an SVG file that forces the program to allocate approximately 674 GB of memory. This allocation attempt results in an out‑of‑memory abort, causing the process to terminate and disrupting any service that relies on ImageMagick. The primary impact is a denial of service that can affect the availability of applications or systems that process image files. The weakness is reflected in CWE-770 and CWE-789.

All versions of ImageMagick prior to 7.1.2-15 and 6.9.13-40 are vulnerable. The affected product is ImageMagick released by the ImageMagick project.

The CVSS score is 7.5, indicating high severity. The EPSS score is less than 1%, suggesting a low probability of exploitation at present, and the weakness is not listed in the CISA KEV catalog. Exploitation requires feeding a malicious SVG file to any ImageMagick instance that processes the file, such as web servers, document conversion services, or local utilities. The attack can be performed remotely if the target accepts arbitrary images from untrusted sources, or locally if an attacker can influence the input file list. The available patch is included in versions 7.1.2-15 and 6.9.13-40. Until patched, the risk is that a successfully exploited ImageMagick process will abort, potentially causing service downtime or cascading failures.