A missing check for the maximum memory request in ImageMagick's AcquireAlignedMemory function can lead to an out-of-memory condition when image data is processed. The vulnerability is classified as CWE-770, indicating improper limits or controls on memory allocation. If an attacker forces the library to allocate a very large block of memory, the process may become unresponsive or crash, resulting in a denial of service for the affected service.

ImageMagick versions before 6.9.13-50 and before 7.1.2-25 are vulnerable. These releases lack the guard that was introduced in the patched versions 6.9.13-50 and 7.1.2-25. The vulnerability can affect any deployment of these older binaries, including those bundled in Linux and Windows distributions.

The CVSS score of 7.5 indicates high severity. No EPSS data is available, and the issue is not listed in CISA's KEV catalog, suggesting limited public exploitation evidence. Based on the description, it is inferred that an attacker could trigger the out-of-memory condition by providing a specially crafted image to any component that processes images with an exposed or public interface. The likelihood of exploitation therefore depends on the exposure of the image-handling service; an unprotected or externally accessible service presents a higher risk.