A crafted MIFF image file can trigger an infinite loop in the ImageMagick MIFF decoder. The loop consumes CPU cycles without termination, degrading system performance or halting it entirely. This weakness is linked to improper input validation (CWE‑400) and lack of loop termination control (CWE‑835). An attacker could inject such a file into any system that processes images with ImageMagick, leading to denial of service for legitimate users.

Employees using ImageMagick versions before 7.1.2.23 or 6.9.13‑48 are at risk. The vulnerability applies to all installations of ImageMagick, the open‑source image manipulation library, across Windows, Linux, and macOS. Critical sites serving user‑uploaded images or generating thumbnails are especially exposed if they rely on unsupported ImageMagick releases.

The CVSS score of 7.5 indicates a high severity attack that would be considered high risk by most organizations. Because the EPSS score is not available, the current exploitation probability cannot be quantified, but the lack of a KEV listing suggests no known mass exploitation has been documented yet. The most likely attack vector is the supply of a malicious MIFF file to an application that imports or converts images, which is a common web‑application scenario. No user privilege escalation is required; the impact remains confined to service availability.