A critical denial of service vulnerability in ImageMagick allows unauthenticated remote attackers to exhaust system CPU resources by processing specially crafted PCD image files.

This vulnerability involves an infinite loop within the DecodeImage() function triggered when a PCD file lacks a valid Sync marker. An unauthenticated attacker can exploit this condition to force the application to consume excessive CPU resources, resulting in a complete denial of service for the host system.

Successful exploitation of this vulnerability leads to significant system instability or total service unavailability. Given the CVSS score of 7.5, which reflects the high impact on system availability and the ease of remote exploitation, organizations relying on ImageMagick for automated image processing face a high risk of operational disruption. This flaw is particularly dangerous for web applications that accept user-uploaded imagery, as it can be leveraged to paralyze backend infrastructure without requiring any authentication.

Immediate Action: Update ImageMagick to version 7.1.2-15 or 6.9.13-40, or update Magick.NET components to version 14.10.3 to incorporate the necessary patch.

Proactive Monitoring: Monitor server CPU utilization metrics and system logs for processes stuck in long-running loops or high-load states associated with the ImageMagick binary.

Compensating Controls: Implement file validation and scanning on all incoming image uploads to ensure PCD files conform to expected standards before passing them to the ImageMagick processing engine.

Public Exploit Available: No

The severity of this denial of service vulnerability necessitates immediate patching for all environments that utilize ImageMagick to process external or user-supplied image files. Administrators should prioritize updating to the specified patched versions to prevent potential system-wide resource exhaustion attacks. Until updates are applied, restrict the ability of untrusted sources to submit files for processing by the application.