Technical impact
This vulnerability enables a heap buffer overflow read within the magnify operation of ImageMagick. When an unrecognized magnify:method value is supplied, the software performs an out‑of‑bounds memory read, exposing data that may be stored on the heap. The weakness is classified as CWE-122 and CWE-125, both indicating read‑only buffer overflows.
Affected Systems
The issue applies to the ImageMagick software suite for any build earlier than version 7.1.2-19. No other vendors or product variants are listed as affected.
Risk and Exploitability
The CVSS score of 4.8 reflects moderate severity; the EPSS score is below 1% and the vulnerability is not listed in the CISA KEV catalog. Based on the description, an attacker could craft an image containing an invalid magnify:method value and supply it to an image‑processing service that uses ImageMagick. If the service is exposed to untrusted users or the Internet, the read‑only overflow may allow extraction of sensitive memory contents or, at minimum, cause a service crash leading to denial of service. The lack of write capability limits the risk to information disclosure and availability impact rather than arbitrary code execution.
