ImageMagick before version 7.1.2‑26 suffers from a memory leak in the JNG encoder when a blob operation fails to open a file. The leak occurs because the program allocates memory during the failure path and does not release it, as identified by CWE‑401 and CWE‑772. Repeatedly supplying malformed JNG files that trigger this failure can drain system memory, leading to degraded performance or a denial of service if the host runs out of resources. The CVSS score of 2.1 reflects the relatively low severity, as the vulnerability only causes resource exhaustion and does not directly provide an attacker with code execution or arbitrary network access.

All installations of ImageMagick released before 7.1.2‑26 are affected regardless of operating system. Users running any earlier version on any platform are exposed, and the vulnerability applies to the ImageMagick product as a whole.

The EPSS score of less than 1% indicates a very low likelihood of exploitation under current data, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector involves an attacker who can supply crafted JNG data to the ImageMagick encoder, for example through a web upload, email attachment, or any file ingestion endpoint that accepts JNG files. Successful exploitation would lead to resource exhaustion, affecting availability but not confidentiality or integrity.