ImageMagick's CIP encoder fails to escape data derived from input files when producing Cisco IP Phone XML output. An attacker who can supply a malicious file can inject arbitrary XML markup into the resulting document. This injection could alter the behavior of the XML consumer or embed unintended data, potentially leading to further exploitation downstream.

The vulnerability affects ImageMagick versions preceding 6.9.13‑57 and 7.1.2‑32. Both the 6.x and 7.x branches are susceptible. The affected product is the ImageMagick software, commonly used for image processing. Users running any unsupported or older 6.x or 7.x releases should verify their version and consider immediate remediation.

The CVSS score of 6.9 indicates a medium severity, while the EPSS score is not available and the vulnerability has not been listed in the CISA KEV catalog. The likely attack vector is remote; an adversary can deliver a crafted file to a system that processes CIP encoding, such as through upload or conversion services. Although the injection does not directly enable code execution, it compromises the integrity of the XML output and may serve as a steppingstone for additional attacks.