The vulnerability arises from a missing validation in ImageMagick's MNG coder. A crafted MNG image can trigger processing of more images than allowed by the policy limit, leading to uncontrolled consumption of CPU and memory resources. The weakness corresponds to CWE‑400 and related Resource Exhaustion issues, with the potential to degrade or deny service on the hosting system.

The issue affects installations of ImageMagick older than version 6.9.13‑47 and 7.1.2‑22. Any system running the open‑source image manipulation suite without the recent patch is vulnerable. The vulnerability does not target specific products beyond the core ImageMagick releases, so all derivatives that include the uninformed MNG coder are impacted until an upgrade.

The CVSS base score of 5.3 indicates moderate severity. The EPSS is unavailable, so the current likelihood of exploitation remains unknown. The vulnerability is not listed in CISA KEV, suggesting no known widespread exploitation. Based on the description, the attack window is a privileged or local attacker who can supply a malicious MNG file to a running ImageMagick process. If backend services routinely parse image uploads, the risk of a denial‑of‑service attack is substantial.