A crafted Media Sequence Language (MSL) file triggers a memory leak in the ImageMagick MSL decoder, allowing an attacker to allocate memory without proper deallocation. This results in exhaustion of system memory and forces the application to crash or become unusable, delivering a denial of service. The weakness is a classic resource exhaustion flaw categorized as CWE‑400, and the incorrect handling of resource cleanup also aligns with CWE‑772 (Missing Release of Resource).

The vulnerability impacts ImageMagick versions prior to 7.1.2‑30 and 6.9.13‑55. Systems running the ImageMagick software with these releases are susceptible. Applying a newer release that incorporates the fix removes the defect.

The CVSS score of 6.3 reflects moderate severity, while the EPSS score is not available and the issue is not listed in CISA KEV. The exploit requires the attacker to supply a malicious MSL image to a process that uses ImageMagick; this attack vector is inferred from the description, as it states a crafted image triggers the leak, implying the attacker can provide such an image. The background that image ingestion from untrusted sources is common is also inferred and not explicitly stated in the CVE data. Successful exploitation causes memory exhaustion, resulting in a denial of service that affects availability but not confidentiality or integrity.