ImageMagick is an open-source image manipulation library used widely. The vulnerability lies in the -sample command when a user sets the sample:offset define to a specific value. This configuration triggers an out-of-bounds read in the image parsing routine, allowing the read of data past the intended buffer limits. The read does not alter image data, but it can expose sensitive memory contents such as parts of the host process memory, which could lead to information disclosure or leakage of private data. The weakness is identified as CWE-125: Out-of-Bounds Read.

Vulnerable versions include all releases of ImageMagick 6 before 6.9.13-44 and all releases of ImageMagick 7 before 7.1.2-19. The issue is fixed in ImageMagick 6.9.13-44 and 7.1.2-19. Systems that run these versions and process images with the -sample option, especially with a custom sample:offset define, are at risk.

The CVSS scoring indicates a medium risk with a base score of 5.5. The exploit requires a crafted image that uses the -sample option with a specific offset. Because the vulnerability is triggered only by an image processed by ImageMagick, the attack vector is likely local or opportunistic, depending on the context of image ingestion. No public exploits have been reported and the vulnerability is not yet listed in the CISA KEV database. Nevertheless, the potential for data leakage warrants prompt mitigation.