ImageMagick contains a flaw that can cause an infinite loop while encoding JPEG images that use the `jpeg:extent` option. The bug stems from a `continue` statement inside the binary‑search loop for determining file extent, which, when encode operations fail, never terminates and consumes 100 % of CPU resources. An attacker can craft a malicious image to trigger this behavior, leading to a denial of service by hanging the image‑processing process.

All versions of ImageMagick released before 7.1.2‑15 and before 6.9.13‑40 are affected. The vendor, ImageMagick, provides a patch that was included in these two releases. The software is commonly used in web servers, image‑managing applications, and content‑delivery systems that convert or compress JPEG images.

The vulnerability has a CVSS score of 6.2, indicating a medium impact. EPSS is reported as less than 1 %, implying a very low probability of exploitation in the wild, and it is not listed in the CISA KEV catalog. Nevertheless, attackers could exploit the flaw by supplying a crafted JPEG to any system that encodes images with the `jpeg:extent` option, causing the process to consume all CPU cycles and eventually become unresponsive. The attack vector is inferred to be local or remote through image upload or automated rendering services.