ImageMagick contains a heap buffer over-read in several raw image format handlers. The flaw is triggered when the image dimensions used with the -extract option exceed the dimensions specified with -size, causing the code to read memory beyond the bounds of a buffer. The out-of-bounds read could expose data that should not be readable, leading to potential information disclosure. The weakness is classified as CWE‑122 and CWE‑125, indicating an overflow/underflow of heap memory and buffer over-read respectively.

The vulnerability affects all versions of ImageMagick earlier than 7.1.2‑15 and 6.9.13‑40. The .NET wrapper, Magick.NET, is also affected in releases prior to 14.10.3. Any system running these older versions or processing images through these libraries may be susceptible.

The CVSS score of 5.1 reflects moderate severity, and the EPSS score of less than 1% indicates a low probability of exploitation in the wild. Based on the description, the likely attack vector is local or application-level: a malicious image file could be processed by a vulnerable instance of the software, enabling a reader to cause an out-of-bounds read and potentially expose memory contents. The vulnerability is not listed in CISA’s Known Exploited Vulnerabilities catalog, further suggesting limited public exploitation. The risk therefore remains moderate but not trivial, warranting timely remediation.