A crafted MVG image can trigger a stack overflow in ImageMagick’s decoder due to a missing depth or visited‑set check. This flaw may corrupt stack memory, potentially causing a crash or further memory corruption that could lead to denial of service or, in rare cases, arbitrary code execution. The vulnerability is a form of unchecked input used to compute buffer size, as indicated by CWE‑674.

ImageMagick, ImageMagick governs all versions of the software. Any installation running a version older than 6.9.13‑49 or 7.1.2‑24 is vulnerable; these earlier releases lack the patch that adds the missing depth or visited‑set validation.

The CVSS score of 5.5 reflects moderate severity, mainly associated with resource depletion rather than privilege escalation. The EPSS score is not available, and the flaw is not listed in CISA KEV, implying no known widespread exploitation. The likely attack vector is when an application or system processes an attacker‑crafted MVG file—this could be invoked via a file upload endpoint or batch image processing pipeline. Given the moderate risk and potential for denial of service, users should prioritize remediation.