CVE-2026-64685: ImageMagick Buffer Overflow Vulnerability

CVE-2026-64685 Overview

CVE-2026-64685 is a heap buffer over-read vulnerability [CWE-125] affecting ImageMagick, the widely used open-source image manipulation library. The flaw resides in the BGR decoder, which fails to check for end-of-file conditions in every location during image parsing. A crafted image can trigger an out-of-bounds read from heap memory. The issue affects versions prior to 7.1.2-27 and is patched in version 7.1.2-27.

Critical Impact
A crafted BGR image processed by a vulnerable ImageMagick instance can leak adjacent heap memory contents, exposing sensitive process data to an attacker.

Affected Products

ImageMagick versions prior to 7.1.2-27
Applications and web services that use ImageMagick for image processing
Container images and Linux distributions bundling vulnerable ImageMagick builds

Discovery Timeline

2026-07-30 - CVE-2026-64685 published to NVD
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2026-64685

Vulnerability Analysis

The vulnerability is an out-of-bounds read in the BGR image decoder within ImageMagick. The decoder reads pixel data from an input image expected to be in raw BGR (Blue-Green-Red) format. During decoding, the code advances read pointers across the input buffer to populate pixel channels. The affected code paths do not consistently verify end-of-file (EOF) conditions before each read operation.

When ImageMagick processes a malformed BGR image whose declared dimensions exceed the actual data present, the decoder continues reading past the allocated buffer boundary. This over-read accesses heap memory that belongs to other allocations within the process address space. The attacker does not control the values read, but the disclosed bytes may be reflected in decoded output, error messages, or subsequent conversion artifacts.

The attack vector is network-reachable in any deployment that accepts user-supplied images, such as upload endpoints, thumbnail generators, and content management systems.

Root Cause

The root cause is missing bounds validation in the BGR decoder loop. Read operations advance through the input stream without checking EOF at every location where a boundary crossing is possible. This classic input validation failure maps to [CWE-125: Out-of-bounds Read].

Attack Vector

An attacker crafts a BGR image whose header specifies pixel dimensions larger than the supplied pixel payload. Submitting this image to any application that invokes ImageMagick for decoding or conversion triggers the over-read. No authentication or user interaction is required when the target application exposes an image processing endpoint.

See the GitHub Security Advisory for the upstream technical details.

Detection Methods for CVE-2026-64685

Indicators of Compromise

ImageMagick process crashes or AddressSanitizer heap-buffer-overflow reports when handling .bgr, .bgra, or raw pixel format inputs
Unexpected magick or convert invocations processing images with mismatched header dimensions versus payload size
Anomalous outbound responses from image processing services containing binary artifacts inconsistent with the source image

Detection Strategies

Inventory hosts running ImageMagick and compare installed versions against 7.1.2-27 using package management queries
Enable and monitor ImageMagick policy logging to identify processing of raw BGR inputs from untrusted sources
Fuzz image ingestion endpoints in staging with malformed BGR samples to confirm patched behavior

Monitoring Recommendations

Alert on repeated segmentation faults or abnormal terminations of image processing workers
Log all image conversion requests with source IP, MIME type, declared dimensions, and file size for correlation
Track ImageMagick package versions across the fleet and flag drift from the patched baseline

How to Mitigate CVE-2026-64685

Immediate Actions Required

Upgrade ImageMagick to version 7.1.2-27 or later on all affected systems
Rebuild container images and redeploy workloads that bundle ImageMagick as a dependency
Restrict accepted image formats at the application layer to those required by business logic

Patch Information

The issue is resolved in ImageMagick 7.1.2-27. The upstream fix adds the missing end-of-file checks within the BGR decoder. Refer to the ImageMagick GitHub Security Advisory GHSA-7rgw-xg25-prjm for commit references and release notes.

Workarounds

Disable the BGR and BGRA coders in policy.xml if raw pixel formats are not required by the application
Enforce strict MIME type and file signature validation before passing images to ImageMagick
Run ImageMagick in a sandboxed process with reduced privileges and constrained memory to limit disclosure impact

bash

# policy.xml example: disable BGR/BGRA coders until patching is complete
# Add inside the <policymap> element of /etc/ImageMagick-7/policy.xml
<policy domain="coder" rights="none" pattern="BGR" />
<policy domain="coder" rights="none" pattern="BGRA" />

# Verify installed version meets the patched baseline
magick -version | head -n1