ImageMagick does not validate arguments supplied to the connected-components option; when invalid arguments are provided the program enters an endless loop, consuming CPU and memory until the process is terminated. This flaw maps to uncontrolled resource consumption (CWE-400) and infinite loop (CWE-835) and does not allow privilege escalation or remote code execution.

Versions of ImageMagick older than 6.9.13‑51 and 7.1.2‑26 are vulnerable when the connected‑components option is enabled. Any deployment that processes images with this option—such as web servers, content management systems, or automated image‑processing pipelines—can be impacted if it uses an unpatched build.

The CVSS score of 4.7 indicates a moderate severity. The EPSS score of less than 1% indicates a very low probability of exploitation at present. The vulnerability is not listed in the CISA KEV catalogue. Based on the description, the likely attack vector is the use of invalid arguments supplied through an image file, command line, or API that invokes the connected‑components option. While this can cause a denial‑of‑service condition for the host running ImageMagick, no higher‑level effects such as remote code execution are indicated.