CVE-2026-64685 is a heap over-read in ImageMagick's BGR decoder caused by a missing EOF validation check. The vulnerability has CVSS 5.3 and EPSS 0.00197, indicating low immediate exploitation probability — but these metrics can mislead if you focus on the number instead of the pattern.
The BGR format is unusual: it's typically a pixel ordering within container formats like BMP or TGA, not a standalone file format. ImageMagick's dedicated BGR decoder handles raw pixel data without headers — meaning there's no intrinsic size metadata the parser can validate against. EOF is the only boundary. When that check is missing, the decoder reads past the allocated buffer into heap memory. This is a well-known vulnerability class in parsers, appearing across libjpeg, libpng, and libtiff over decades. ImageMagick's architecture — supporting 200+ format handlers as independent parsers — makes this class of bug predictable rather than exceptional.
What matters for defenders: first, identify whether your ImageMagick pipelines accept BGR-formatted input or process raw pixel data. If you're converting user-uploaded images, you're likely exercising this code path regardless of the input extension — ImageMagick detects format from content. Second, understand that the low EPSS score reflects the BGR format's rarity, not the bug's severity class. Heap over-reads can leak sensitive heap data and may be chainable with other issues.
The more important concern is architectural: raw pixel decoders like BGR are inherently more dangerous than container-based formats because they lack size metadata. If ImageMagick hasn't categorized handlers by whether they carry intrinsic size information and applied tiered validation accordingly, this CVE is likely one instance of a recurring pattern. Legacy format handlers in large codabases tend to accumulate "entropy of attention" — code that shipped years ago and receives minimal scrutiny as the surrounding codebase evolves.
Practical steps: audit image processing pipelines for raw pixel format exposure, ensure ImageMagick versions are current, and treat the pattern (missing bounds checks in obscure format handlers) as a risk category rather than a one-off. If you operate systems processing untrusted images at scale, the blast radius of this class of vulnerability is determined more by your deployment footprint than by individual CVSS scores.