ImageMagick 7.1.1-7 up to 7.1.2-31 contains a heap buffer over‑read flaw caused by incorrect string termination when parsing XMP profiles. By supplying a crafted image that includes a malformed XMP profile, an attacker can trigger the over‑read, potentially allowing the program to read memory outside the intended buffer and causing a crash. While the current description does not confirm arbitrary code execution, the read of unintended memory could expose sensitive data or destabilize the service.

The vulnerable product is ImageMagick, version 7.1.1-7 and any earlier release before 7.1.2-32. ImageMagick is a widely used open‑source image processing library found on many web, desktop, and embedded systems that convert or analyse images.

The base CVSS score of 6.9 indicates a moderate risk level. No EPSS score is available, and the vulnerability is not listed in CISA’s KEV catalog, suggesting low exploitation probability so far. The likely attack vector is the supply of a malicious image file, which can be uploaded or processed over a network, making the flaw remotely exploitable via the XMP profile parser.