The vulnerability is an uninitialized heap memory disclosure located in the GIF decoder's application extension handler. Attackers can craft malicious GIF files that cause the number parser to read uninitialized heap memory and store the contents as image metadata, revealing sensitive data that resides in heap memory. This weakness falls under CWE‑908 and results in unintended disclosure of confidential information.

ImageMagick versions before 7.1.2‑32 and 6.9.13‑57 are affected. The product is the ImageMagick image processing library.

The CVSS score of 6.3 indicates moderate severity. Because the EPSS score is unavailable and the vulnerability is not in the CISA KEV catalog, the current exploitation likelihood is unclear. The attack vector is inferred to be through the processing of arbitrary GIF files supplied to the vulnerable library, which can be triggered locally by any process using ImageMagick or remotely via a web or service that does not verify image provenance. Once processed, the attacker gains read access to portions of heap memory, potentially leaking sensitive data.