ImageMagick contains a missing depth check in its MVG decoder that can trigger a stack overflow when a crafted image is parsed. This oversight results in a buffer overflow that corrupts the stack and causes the application to crash or become unresponsive, fulfilling the criteria of CWE-400, CWE-674, and CWE-787.

Any installation of ImageMagick older than version 6.9.13-51 or 7.1.2-26 is affected, because the vulnerability resides in the core MVG decoder code. This applies to all configurations, and any process that may load an MVG file—whether locally or through a network interface—falls within the risk scope.

The likely attack vector is the delivery of a malicious MVG file to an ImageMagick instance, such as via uploading a crafted image to a web application or sending a payload over a network protocol that triggers image parsing. The CVSS score of 5.3 indicates a moderate risk level, the EPSS score of less than 1% reflects a low likelihood of exploitation, and the vulnerability is not listed in the CISA KEV catalog. Accordingly, the impact is limited to a denial of service without remote code execution or other higher‑level privileges.