ImageMagick versions 7.1.0-21 through 7.1.2-31 contain a heap buffer over-read when handling the -fx command‑line option. A specific -fx expression can cause the program to read beyond the bounds of an allocated heap buffer, exposing partial contents of out‑of‑bounds memory. The vulnerability can lead to disclosure of limited internal memory data, potentially revealing sensitive information that the image processing context might hold.

All installations of ImageMagick 7.1.0‑21 to 7.1.2‑31, regardless of operating system or deployment environment, are affected. The issue has been fixed in releases 7.1.2‑32 and later. Users running older ImageMagick 7.1.x versions should verify their version and consider upgrading.

The CVSS score of 4.8 indicates moderate severity, and the vulnerability is not listed in CISA’s KEV catalog. The EPSS score is unavailable, so current exploitation likelihood cannot be quantified. Attackers who can supply a crafted -fx expression—such as through an untrusted image file or user input—may read out‑of‑bounds heap memory. The attack vector requires that the attacker control the -fx expression or influence an automated process that does so, which is typically a local or remotely executable situation depending on how ImageMagick is invoked.