Heap Buffer Over-read Vulnerability in ImageMagick by ImageMagick
CVE-2026-64685

5.3MEDIUM

Key Information:

Vendor

Imagemagick
Status
Imagemagick
Vendor
CVE Published:
29 July 2026

What is CVE-2026-64685?

ImageMagick, a widely used open-source software for digital image processing, has a vulnerability in its BGR decoder that can lead to a heap buffer over-read. This flaw occurs due to insufficient end-of-file checks in version 7.1.2-27 and earlier. When exploited using a crafted image, it may permit unauthorized access to memory. Users are advised to upgrade to the latest version of ImageMagick to mitigate potential security risks associated with this vulnerability.

Affected Version(s)

ImageMagick < 7.1.2-27

References

https://github.com/ImageMagick/ImageMagick/security/advis...
x_refsource_CONFIRM

CVSS V3.1

Score:
5.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.