ImageMagick contains an off‑by‑one error in its meta encoder that can cause an out‑of‑bounds read of a single byte. This flaw falls under CWE‑125 and CWE‑193 and may allow an attacker to read adjacent memory, potentially revealing sensitive data. The vulnerability does not provide a direct execution path, and the data exposed is limited to what resides next to the read byte.

All installations of ImageMagick version 6.9.13‑46 and earlier, as well as 7.1.2‑21 and earlier, are affected. Software built against these releases on any platform that processes untrusted images is at risk.

The CVSS score of 5.3 reflects a moderate impact; the EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is local or remote via a crafted image that is processed by the vulnerable meta encoder. Exploitation requires the attacker to supply or influence the image data, and the feasibility is moderate due to the single-byte read and limited impact.