ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 includes an information disclosure flaw in the PostScript decoder. The decoder allocates a buffer one byte longer than the data it decodes, allowing an attacker to craft a PostScript file that exposes a single uninitialized memory byte. This results in a small but potentially sensitive leak of memory contents. The weakness corresponds to an uninitialized memory reading scenario.

The vulnerability affects the ImageMagick software, specifically releases up to and including 6.9.13-57 and 7.x versions prior to 7.1.2-32. Any system running these versions through the ImageMagick library is potentially impacted.

The CVSS score of 6.9 indicates a moderate level of severity. No EPSS score is available, and the issue is not listed in the CISA Known Exploited Vulnerabilities catalog. The likely attack vector involves an attacker who can supply a crafted PostScript file to an application that processes such files with ImageMagick. By submitting a maliciously designed file, the attacker can read the uninitialized byte, potentially revealing sensitive data that resides in memory. The scope of impact is limited to the memory space of the process executing the decoder, but the information disclosed could be valuable for sophisticated attackers.