CVE-2026-64685

ImageMagick: Heap Buffer Over-Read in BGR decoder due to mising end-of-file check

Published Jul 29, 2026 CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Description

ImageMagick is free and open-source software used for editing and manipulating digital images. In versions prior to 7.1.2-27, the BGR decoder does not check for an end-of-file in every location so a crafted image could result in an heap buffer over-read. This issue has been fixed in version 7.1.2-27.

Analysis

Technical impact

A missing end-of-file check in ImageMagick's BGR decoder allows a crafted image to trigger a heap buffer over-read. The vulnerability can cause the software to read memory beyond the intended buffer boundaries, potentially exposing sensitive data or causing a denial of service by crashing the program. It represents a vulnerability in memory safety (CWE-125) but does not provide direct code execution or other higher-level exploits.

Affected Systems

ImageMagick ImageMagick versions prior to 7.1.2-27 are affected. The issue was fixed in 7.1.2-27; all other earlier releases remain vulnerable.

Risk and Exploitability

The CVSS score of 5.3 indicates moderate severity, while the EPSS score of less than 1% suggests very low likelihood of exploitation at this time. The vulnerability is not listed in the CISA KEV catalog, further indicating lower exposure risk. Exploitation would require an attacker to craft a malicious image that is processed by the software, which is feasible in contexts where the application accepts untrusted image input. No remote code execution or privilege escalation is possible directly from this over-read.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

ImageMagick

affected

Version	Status	Constraints
`< 7.1.2-27`	affected	—

Configuration 1 [-]

cpe:2.3:a:imagemagick:imagemagick:*:*:*:*:*:*:*:*

No data.

Vendor Product Versions

Imagemagick

Version	Status	Scheme	Platform
`[0,7.1.2-27)`	affected	semver	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Apply the vendor patch by upgrading ImageMagick to version 7.1.2-27 or later.
Remove or replace any older ImageMagick binaries or libraries from all affected systems and redeploy the updated binaries.
Configure the image ingestion process to validate or filter suspicious image files until the patch is fully deployed, thereby reducing the window of exposure.

Generated by OpenCVE AI on August 2, 2026 at 07:37 UTC.

Tracking

Advisories

Source	ID	Title
Debian DLA	DLA-4858-1	imagemagick security update

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact Low

Integrity Impact None

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.214% probability within 30 days)

Exploitation none

Automatable yes

Technical Impact partial

References

Link	Providers
https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-7rgw-xg25-prjm
https://nvd.nist.gov/vuln/detail/CVE-2026-64685
https://www.cve.org/CVERecord?id=CVE-2026-64685

History

Jul 30, 2026 4:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Jul 30, 2026 12:15 PM Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
References		https://nvd.nist.gov/vuln/detail/CVE-2026-64685 https://www.cve.org/CVERecord?id=CVE-2026-64685
Metrics	threat_severity `None`	threat_severity `Moderate`

Jul 30, 2026 1:45 AM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Imagemagick Imagemagick imagemagick
Vendors & Products		Imagemagick Imagemagick imagemagick

Jul 30, 2026 12:15 AM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		ImageMagick is free and open-source software used for editing and manipulating digital images. In versions prior to 7.1.2-27, the BGR decoder does not check for an end-of-file in every location so a crafted image could result in an heap buffer over-read. This issue has been fixed in version 7.1.2-27.
Title		ImageMagick: Heap Buffer Over-Read in BGR decoder due to mising end-of-file check
Weaknesses		CWE-125
References		https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-7rgw-xg25-prjm
Metrics		cvssV3_1 `{'score': 5.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N'}`