ImageMagick, an open‑source image editing tool, contains a flaw that triggers an infinite loop when writing the IPTCTEXT resource for a crafted profile with invalid IPTC data. The loop can consume CPU resources until the process is terminated, leading to a denial of service. The underlying weakness is a use of unvalidated input that causes a runaway loop, reflected in CWE-400 and CWE-835.

The vulnerability affects all ImageMagick installations that are older than versions 7.1.2‑15 and 6.9.13‑40. Any system running these older releases and processing user‑supplied images that include IPTCTEXT metadata is potentially exposed. The vendor released patches that address the infinite loop in both 7.x and 6.x branches.

The CVSS score of 6.2 indicates a medium severity risk, while the EPSS score of less than 1% suggests a very low likelihood of exploitation in the wild, and the flaw is not currently listed in CISA's KEV catalog. The likely attack vector is local or remote image processing if the software is exposed to untrusted image uploads; a malicious profile can be crafted to trigger the loop during ordinary processing. Mitigation is straightforward by upgrading to the patched releases; until then, restricting IPTCTEXT usage or sanitizing input can reduce exposure.