A missing end-of-file check in ImageMagick's BGR decoder allows a crafted image to trigger a heap buffer over-read. The vulnerability can cause the software to read memory beyond the intended buffer boundaries, potentially exposing sensitive data or causing a denial of service by crashing the program. It represents a vulnerability in memory safety (CWE-125) but does not provide direct code execution or other higher-level exploits.

ImageMagick ImageMagick versions prior to 7.1.2-27 are affected. The issue was fixed in 7.1.2-27; all other earlier releases remain vulnerable.

The CVSS score of 5.3 indicates moderate severity, while the EPSS score of less than 1% suggests very low likelihood of exploitation at this time. The vulnerability is not listed in the CISA KEV catalog, further indicating lower exposure risk. Exploitation would require an attacker to craft a malicious image that is processed by the software, which is feasible in contexts where the application accepts untrusted image input. No remote code execution or privilege escalation is possible directly from this over-read.