ImageMagick’s distributed pixel cache was originally designed without a challenge–response authentication model, allowing an attacker to read pixel data that the server accessed. This flaw can expose image contents to unauthorized parties, compromising confidentiality of image assets. The weakness is classified as CWE-200, an information disclosure vulnerability.

The vulnerability affects all deployments of ImageMagick prior to versions 6.9.13‑48 and 7.1.2‑23. Users running older releases of ImageMagick, including any custom builds that enable the distributed pixel cache, are potentially impacted and should verify their current version.

The CVSS score of 4.1 indicates a moderate risk. EPSS data is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting no confirmed exploits in the wild. If the pixel cache server is exposed to the network, the attack vector is likely remote, as an adversary could connect to the server and retrieve pixel data. If the server is isolated, the risk may be limited to local or compromised hosts.