The vulnerability originates from the FX expression parser in ImageMagick, which fails to enforce a recursion depth limit and therefore overflows the processor stack when handling a deeply nested expression. This results in the ImageMagick process terminating unexpectedly, causing a denial of service. The weakness is classified as a stack overflow and resource exhaustion, matching CWE‑674 and CWE‑770.

ImageMagick, the image processing library. All releases earlier than 7.1.2‑19 and 6.9.13‑44 are affected.

The CVSS score of 5.5 indicates medium severity. No EPSS score is available and the vulnerability is not listed in CISA’s KEV catalog. An attacker must provide a malicious FX expression to a running ImageMagick instance; the resulting crash can interrupt services that rely on the library. The risk is elevated in environments where ImageMagick processes untrusted input, such as web servers or document conversion services.