The vulnerability resides in the Drupal Combined image style module and allows an attacker to surreptitiously allocate system resources without any predefined limits or throttling. This weakness, identified as CWE-770, can result in the module exhausting available memory or processing capacity, thereby causing the host application or web server to become unresponsive or crash. The primary consequence is a loss of availability for affected Drupal sites, with no direct impact on confidentiality or integrity of data.

Drupal's Combined image style module is affected, with all releases from version 0.0.0 through 1.0.7 vulnerable. Administrative and user‑generated image requests that trigger the module are the points of potential exploitation.

The EPSS score for this vulnerability is < 1% and it is not listed in CISA KEV. The CVSS score of 5.3 indicates medium severity. The most likely attack vector is remote, where a malicious user or bot performs repeated image style requests to exhaust server resources. Based on the description, it is inferred that the exploit does not require special privileges and can be initiated through legitimate-looking web requests, making the vulnerability actionable for an attacker with internet access to the Drupal site.