ImageMagick CVE-2026-64685

The target service must accept user-supplied image files and process them with ImageMagick prior to version 7.1.2-27, specifically invoking the BGR decoder on the crafted input - no non-default configuration is required since the BGR decoder is part of the standard ImageMagick installation. Per the CVSS vector (PR:N, UI:N), no authentication and no victim interaction are required. Exploitation is limited to information disclosure (C:L); there is no integrity or availability impact, and the over-read does not provide a write primitive. The primary limiting factor on practical exploitability is whether the application exposes decoded output or error details to the attacker - silent background processing pipelines that discard all output substantially reduce the attacker's ability to recover disclosed memory contents.

The CVSS 3.1 score of 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) reflects a moderate, network-accessible vulnerability requiring no authentication or user interaction, but with impact strictly limited to low-level confidentiality - partial heap memory disclosure. No EPSS score was provided in the available data, preventing probabilistic exploitation comparison. The absence of a CISA KEV listing and the lack of any identified public POC suggest this is not currently being targeted opportunistically. The practical risk is further shaped by deployment context: services that silently process and discard image output (e.g., background thumbnail generators) are significantly less exploitable than those that reflect processed output or error details to the caller. The unchanged scope (S:U) confirms exploitation is bounded to the ImageMagick process itself. Priority should be moderate - include in the next planned patching cycle, with urgency elevated only for high-sensitivity image-processing pipelines exposed to untrusted input.

An attacker uploads or submits a specially crafted BGR image to a web application or API endpoint that passes the file to a vulnerable ImageMagick installation for processing. During decoding, the BGR decoder reads past the end of the heap buffer due to a missing EOF check, exposing adjacent heap memory. If the application returns error messages, processed image data, or diagnostic output to the requester, the attacker may recover fragments of heap memory that could include sensitive runtime values such as pointers or buffered data from other operations.