ImageMagick’s MAP image decoder can perform a heap buffer over‑read when handling specially crafted MAP files, allowing an attacker to trigger a crash or read adjacent memory. This flaw is classified as CWE‑125, indicating an out‑of‑bounds read that could reveal sensitive data. The vulnerability is limited to image decoding and does not give the attacker arbitrary code execution. The impact is a possible information disclosure or denial of service, depending on the context.

All installations of ImageMagick using versions older than 7.1.2‑15 and 6.9.13‑40 are affected. The patch is included in ImageMagick 7.1.2‑15 and 6.9.13‑40, so any deployment running these or later releases is safe.

The CVSS score of 5.3 indicates moderate severity. The probability of exploitation is below 1 %, and it is not listed in CISA’s Known Exploited Vulnerabilities catalog. The likely attack vector is remote: an attacker can supply a malicious MAP image to any application or service that processes images with ImageMagick. The flaw requires only the ability to deliver a crafted image, making it relatively easy to test and exploit in practice, but the low exploitation probability suggests uncommon real‑world exploitation to date.