The vulnerability exists because ImageMagick can enter an infinite loop during its subimage-search operation when processing a specially crafted image. The resulting endless cycle consumes system resources and can cause the application to hang or crash, effectively denying service to legitimate users. This weakness is classified as CWE-835, an infinite loop condition.

The flaw affects all releases of ImageMagick prior to 6.9.13-49 and 7.1.2-24. Systems that use older ImageMagick binaries in any image processing pipeline—such as web servers, media converters, or content management systems—are potentially impacted.

ImageMagick receives a CVSS score of 4.7, indicating a moderate impact. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting limited known exploitation activity. The attack vector is inferred: an attacker would need to supply a crafted image to a vulnerable instance. Environments that accept user‑supplied images for processing—common in web services—are the most likely targets, though no privileged execution is required for exploitation.