ImageMagick versions prior to 6.9.13-57 and 7.x prior to 7.1.2-32 contain an uninitialized memory read in the TGA image decoder. A crafted TGA file supplied to the decoder can expose contents of image‑process memory, allowing an attacker to read sensitive data such as passwords, cryptographic keys, or other confidential information that the ImageMagick process holds. The weakness is a classic example of a confidential data exposure flaw (CWE‑200) and an improper memory access flaw (CWE‑908).

All installations of ImageMagick using the affected releases, specifically ImageMagick version 6.9.13-57 and earlier, and any 7.x release before 7.1.2-32. The vulnerability applies to the general ImageMagick product regardless of operating system; any system that processes TGA images with these versions is potentially exposed.

The CVSS score of 6.9 indicates moderate severity, and the absence of an EPSS score means current exploitation probability is unclear. The vulnerability is not listed in the CISA KEV catalog, suggesting no known widespread exploitation at this time. Attackers can exploit the flaw by supplying a malicious TGA file either locally or remote through any service that imports images, thereby triggering the uninitialized memory read. The impact is limited to the application process, but the disclosed memory can contain highly sensitive data, making it a serious confidentiality concern.