An infinite loop vulnerability in ImageMagick allows unauthenticated remote attackers to trigger a denial of service condition by processing maliciously crafted XMP files.

The software contains an infinite loop flaw (CWE-835) occurring during the writing phase of specific XMP file conversions. An unauthenticated attacker can trigger this condition by supplying a specially crafted file to the application, resulting in resource exhaustion.

This vulnerability poses a significant risk to system availability, as a successful exploit will cause the affected service to hang or consume excessive CPU resources. Given the CVSS score of 7.5, this is classified as a high-severity issue that could lead to service outages in environments where ImageMagick is used to process user-supplied images.

Immediate Action: Update ImageMagick to version 7.1.2-0 or later. For .NET environments, update the Magick.NET packages to version 14.7.0.

Proactive Monitoring: Monitor server CPU utilization and process logs for instances where the ImageMagick utility enters a prolonged, high-usage state during file conversion tasks.

Compensating Controls: Implement strict file type validation and size limits on all image processing endpoints to reduce the attack surface for malicious file uploads.

Public Exploit Available: Unknown.

The risk of service disruption is high for applications that process untrusted image uploads. Security teams should prioritize patching ImageMagick to version 7.1.2-0 across all production environments to neutralize this denial of service vector. Immediate action is required to ensure system stability against potential automated exploitation.