ImageMagick is free and open-source software used for editing and manipulating digital images. In versions prior to 7.1.2-27, the BGR decoder does not check for an end-of-file in every location so a crafted image could result in an heap buffer over-read. This issue has been fixed in version 7.1.2-27.

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21635-1 advisory.

    - CVE-2026-56365: memory leak in the PNG encoder when writing MNG images (bsc#1270004).
    - CVE-2026-62343: heap buffer overwrite in morphology operation when an invalid kernel is provided     (bsc#1272575).
    - CVE-2026-62363: heap buffer overwrite in fx operation when processing a crafted argument (bsc#1272582).
    - CVE-2026-62946: integer overflow in JNX decoder leading to heap buffer overwrite when extremely large     files are       processed on 32-bit builds (bsc#1272580).
    - CVE-2026-66011: memory leak in the magick command-line interface when invalid options are provided     (bsc#1272577).
    - CVE-2026-64685: heap buffer overread in BGR decoder due to missing end-of-file check (bsc#1272953).
    - Code injection in HTML encoder due to incomplete fix of CVE-2026-25797 (bsc#1272579).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2026:3571-1 advisory.

    This update for ImageMagick fixes the following issue:

    - CVE-2026-64685: heap buffer overread in BGR decoder due to missing end-of-file check (bsc#1272953).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2026:3586-1 advisory.

    This update for ImageMagick fixes the following issue:

    - CVE-2026-64685: heap buffer over-read in BGR decoder due to missing end-of-file check (bsc#1272953).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote host has a version of ImageMagick 7.x installed that is prior to 7.1.2-27. It is, therefore, affected by multiple vulnerabilities:

  - The BGR decoder does not check for an end-of-file in every location so a crafted image could result in a heap     buffer over-read. (CVE-2026-64685)

  - A heap buffer over-write can occur in the fx operation by passing a crafted argument. (CVE-2026-62363)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - ImageMagick is free and open-source software used for editing and manipulating digital images. In versions     prior to 7.1.2-27, the BGR decoder does not check for an end-of-file in every location so a crafted image     could result in an heap buffer over-read. This issue has been fixed in version 7.1.2-27. (CVE-2026-64685)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
341164	openSUSE 16: ImageMagick / ImageMagick-config-7-SUSE / etc (openSUSE-SU-2026:21635-1)	Nessus	SuSE Local Security Checks	Local	medium
335094	SUSE SLED15 / SLES15 Security Update : ImageMagick (SUSE-SU-2026:3571-1)	Nessus	SuSE Local Security Checks	Local	medium
335092	SUSE SLED15: ImageMagick / ImageMagick-config-7-SUSE / etc (SUSE-SU-2026:3586-1)	Nessus	SuSE Local Security Checks	Local	medium
334464	ImageMagick 7.x < 7.1.2-27 Multiple Vulnerabilities	Nessus	Misc.	Local	medium
331157	Linux Distros Unpatched Vulnerability : CVE-2026-64685	Nessus	Misc.	Local	medium

Detections

Analytics

CVE-2026-64685

medium

Tenable Plugins

medium

medium

medium

medium

medium