ImageMagick can be tricked into processing a crafted image that bypasses a security policy when the policy uses the 'coder' keyword as its domain. This flaw means the image processing engine may read files or data that the policy explicitly forbids, compromising confidentiality. The weakness is classified as CWE-551 and CWE-552.

The vulnerability affects the main ImageMagick project prior to release 7.1.2-31 for the 7.x series and prior to 6.9.13-56 for the 6.x series. Systems running these older versions should update to the mentioned releases or newer. No other products or specific versions were listed as affected.

The CVSS score of 6.2 indicates moderate severity. Since the EPSS score is not available and the CVE is not in the CISA KEV catalog, there is no public evidence of active exploitation, but the attack vector is likely via a crafted image file that an attacker can supply to the vulnerable installation. The vulnerability is exploitable when an attacker can supply image input to the ImageMagick engine, and no special conditions beyond the presence of the policy you described are required.