The vulnerability allows an attacker to override ImageMagick’s secure policy and access standard input and output streams by using the fd: pseudo-filename syntax (e.g., fd:0, fd:1). This bypass of the policy can lead to unintended data reads or writes, exposing sensitive information or permitting malicious content to be injected through the standard streams. The weakness is an improper access control flaw (CWE-284) and an information transfer flaw (CWE-184). The impact is therefore a moderate level of data exposure and potential misuse of the image processing service.

ImageMagick installations built on versions older than 7.1.2‑15 or 6.9.13‑40 are vulnerable. The flaw resides in the default security policy file, config/policy-secure.xml, where the rule that blocks standard stream access does not apply to fd: references. The affected product is the ImageMagick image manipulation library and its associated command-line tools.

The CVSS score of 5.9 indicates a moderate risk. The EPSS score of less than 1% suggests a low probability of exploitation at this time, and the vulnerability is not included in CISA’s Known Exploited Vulnerabilities catalog. The likely attack vector is local or remote through any application that accepts user-supplied image data and passes it to ImageMagick with standard stream operations; an attacker who can craft such input can read from or write to the process’s stdin or stdout.