ImageMagick, a widely used image editing library, contains a heap buffer over-read flaw in its distributed pixel cache server that allows an attacker who can connect to the magick -distribute-cache service to read memory beyond the intended buffer. This out‑of‑bounds read (CWE‑125) may expose sensitive data stored in memory and is compounded by an authentication bypass weakness (CWE‑287). The vulnerability is not a remote code execution flaw, but it can leak confidential information to the attacker.

The flaw affects ImageMagick versions prior to 6.9.13‑48 and versions prior to 7.1.2‑23. Any installation that exposes the distributed pixel cache service to untrusted users is vulnerable until updated to the patched releases.

With a CVSS score of 5.7 this vulnerability is considered medium severity. No EPSS score is currently available, and the issue is not listed in the CISA KEV catalog, reducing the likelihood of widespread exploitation. However, the attack requires the ability to connect to the magick -distribute-cache service, so systems exposed on public networks or with inadequate network segmentation could be targeted. Once exploited, the attacker can read arbitrary memory contents from the server process.