ImageMagick, a widely used open source image manipulation library, contains a flaw in the PCD (Photo CD) decoder. The decoder performs Huffman‑coded data decoding without sufficient boundary validation, allowing an attacker to supply a crafted PCD file that triggers an out‑of‑bounds read. This memory corruption can expose internal state or, if exploited further, could potentially lead to information disclosure or denial of service. The weakness corresponds to multiple weaknesses including buffer overread and improper array index validation.

The vulnerability affects the ImageMagick ImageMagick product prior to versions 7.1.2-15 and 6.9.13-40. Systems running those earlier releases that process PCD files are susceptible. The patched releases 7.1.2-15 and 6.9.13-40 contain the necessary bounds checking and are no longer vulnerable.

The CVSS score of 6.5 indicates medium severity, and the EPSS score of less than 1% implies a low likelihood of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. Attackers would need to supply a malicious PCD file to an ImageMagick instance. If the image processing environment is exposed to untrusted input, the risk increases, but no confirmed remote code execution vector exists; the principal risk is memory corruption that could crash or leak data.