ImageMagick frees the memory of the XML tree through the DestroyXMLTree() function without imposing a depth limit on the recursive cleanup. When an XML document with deeply nested structures is processed, the stack is exhausted, causing the application to terminate. The primary consequence is a denial of service that can prevent the affected software from processing any further images. The weakness is related to uncontrollable recursion and memory exhaustion.

ImageMagick installations that run versions earlier than 7.1.2‑19 and 6.9.13‑44 are affected. The vulnerability exists in the core ImageMagick product and its .NET bindings such as Magick.NET. Any instance that processes XML input from untrusted sources using these versions is at risk.

The CVSS score of 7.5 places this issue in the high‑severity range, indicating a significant impact if exploited. While no exploit has been reported in the CISA KEV catalog and the EPSS score is not available, the attack vector is inferred: an attacker can trigger the denial of service by delivering a specially crafted XML file to any ImageMagick instance that accepts untrusted input. The vulnerability is exploitable on a local or remote basis if the ImageMagick engine is invoked by a service exposed to external users.