ImageMagick's BilateralBlurImage function performs an incorrect conversion that can lead to a heap buffer over-read when processing a crafted image with the -bilateral-blur option. The over-read allows an attacker to read memory beyond the intended buffer boundaries, potentially exposing internal data and enabling information disclosure. The weakness is identified as a buffer over-read (CWE‑125) and an integer overflow risk (CWE‑190).

Affected versions are all releases of ImageMagick prior to 7.1.2‑16, including the ImageMagick suite as identified by the CPE entry for imagemagick:imagemagick. No affected products beyond this are listed. The fix is available from version 7.1.2‑16 onward.

The CVSS score of 4.4 indicates a moderate severity. The EPSS score of less than 1% suggests a very low likelihood of exploitation at present. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires an attacker to supply a specially crafted image that triggers the -bilateral-blur operation; such input could arise in environments where images are processed automatically, such as web applications or image services. The lack of a high exploitability score and no public exploitation evidence lowers the immediate risk, but the potential for information disclosure warrants prompt remediation.