Technical impact
The vulnerability is a heap buffer over‑read that occurs when ImageMagick prints a minimum‑bounding‑box of an image. A crafted image can cause the library to read memory beyond the buffer that was allocated for the output. This can lead to a program crash or potentially expose contents of adjacent heap memory, allowing an attacker to glean sensitive data or trigger denial of service.
Affected Systems
ImageMagick versions prior to 7.1.2‑33 are affected. The issue applies to all builds of the ImageMagick suite that use the minimum‑bounding‑box printing feature. Systems that rely on older releases for image processing—including web servers, mail servers, or any application that imports or renders images—are at risk.
Risk and Exploitability
The CVSS base score of 4.8 indicates moderate severity. No EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is local or controlled input, as an attacker must supply a specially crafted image that triggers a minimum‑bounding‑box output. If this path is exposed—for example via file uploads, image attachments, or third‑party content feeds—remote exploitation is possible. The lack of a known exploit and the moderate score suggest the probability of widespread attacks is currently low, but the potential for data disclosure warrants remediation.
