Technical impact
This vulnerability allows an attacker who can supply image input to ImageMagick to evade security policy restrictions that were intended to block certain operations. The result is that the image processor may perform actions that are normally disallowed, potentially compromising data integrity or confidentiality if the bypass permits unauthorized file access or execution of harmful image operations. The weakness is a failure in security checks, known as a policy bypass.
Affected Systems
ImageMagick, versions prior to 6.9.13-58 and all 7.x versions earlier than 7.1.2-32 are affected.
Risk and Exploitability
The CVSS score is 1.8, indicating low overall severity. The EPSS score is not available and the vulnerability is not listed in CISA's KEV catalog, suggesting a low likelihood of widespread exploitation. Based on the described behavior, the likely attack vector is that an attacker provides crafted input to a system component that processes images with ImageMagick; if the component runs with sufficient privileges or on an exposed interface it could trigger the bypass. No other prerequisites are specified, so the vulnerability appears exploitable in any context where ImageMagick processes untrusted input.
Debian DLA