A heap buffer over‑read is triggered when ImageMagick processes images of small dimensions with the wavelet denoise operator. The bug reads beyond the allocated memory region and can leak data residing on the heap, leading to partial exposure of sensitive information to an attacker. No evidence suggests that the flaw can be used to execute code or cause a denial of service; its primary weakness is a classic out‑of‑bounds read (CWE‑125, CWE‑126).

ImageMagick deployments using versions older than 7.1.2‑15 or 6.9.13‑40 are affected. Any software that incorporates the underlying ImageMagick libraries, such as Magick.NET, inherits the same vulnerability until the same patch level is applied. All platforms running these legacy versions on any operating system are at risk if commands or image uploads invoke the wavelet denoise operator.

The CVSS score of 4 indicates a modest confidentiality impact, and the EPSS value of less than 1% signals a very low likelihood of exploitation. The flaw is not listed in the KEV catalog, and it requires an attacker to supply a crafted image that is processed with wavelet denoise. Consequently, the risk is concentrated in systems that accept untrusted images in this context, such as web servers or content‑management platforms that use ImageMagick for image manipulation.