The vulnerability resides in the JPEG decoder of ImageMagick, where a read of uninitialized memory can expose arbitrary memory contents. Attackers can supply a crafted JPEG file to trigger the disclosure, potentially revealing sensitive information such as configuration data or other memory contents. This flaw is classified as CWE‑125 and CWE‑908, representing information exposure through improper handling of uninitialized buffers and an additional buffer overread scenario.

ImageMagick versions prior to 6.9.13‑57 and versions 7.x prior to 7.1.2‑32 are affected. These are the releases distributed under the ImageMagick:ImageMagick identifier, covering both the 6.x and 7.x series.

The CVSS score of 6.9 indicates a medium-to-high risk, but the EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting limited active exploitation. The attack vector is likely local or remote via supply of a malicious JPEG file, meaning any process that accepts JPEG input is potentially vulnerable. Because no official patch is listed in the provided data, the risk remains medium until an update is applied.