In ImageMagick 7.0.7-37 Q16, SetGrayscaleImage in the quantize.c file allows attackers to cause a heap-based buffer over-read via a crafted file. https://nvd.nist.gov/vuln/detail/CVE-2018-11625