The vulnerability arises from an integer truncation bug in the calculation of the stride for the pixel buffer while parsing DJVU images. This causes a 32‑bit signed integer overflow, leading to a heap buffer over‑read that can expose arbitrary heap memory contents. The flaw is a classic buffer over‑read (CWE-122/125/126) and could result in information disclosure or potential corruption of data processed by ImageMagick.

ImageMagick versions prior to 7.1.2-15 and 6.9.13-40 are affected. The flaw also applies to users that employ the .NET wrapper Magick.NET, which relies on the underlying ImageMagick libraries. The security notes reference patches that are included starting in those versions, and Magick.NET releases 14.10.3 incorporate the fix.

The CVSS score of 4.0 indicates a moderate severity, and the EPSS of less than 1% implies a very low expected exploitation rate. It is not listed in the CISA KEV catalog, so no confirmed exploit is known. Based on the type of vulnerability, the attack would require a crafted DJVU image to be processed by the affected library. If the library is used in a public‑facing application, an attacker could potentially trigger the buffer over‑read by uploading such a file, exposing sensitive heap data.