Executive brief
ImageMagick, a widely used software suite for editing and converting images, contains a flaw in how it processes specific text-based image formats. An attacker could provide a specially crafted image file that, when processed, causes the application to crash or potentially leak small amounts of memory. This could lead to a temporary service disruption for applications that rely on ImageMagick to process user-uploaded content.
Technical details
A heap buffer overflow (specifically an out-of-bounds read) exists in ImageMagick's FTXT encoder. The vulnerability is caused by missing boundary checks when the software parses the 'ftxt:format' parameter within an image file. An attacker can exploit this by crafting a malicious FTXT file that, when processed by a vulnerable version of ImageMagick, triggers an AddressSanitizer-detected heap-buffer-overflow. The attack requires local execution or user interaction (opening a file) and primarily impacts availability (denial of service) or potentially confidentiality (information disclosure). The issue is resolved in version 7.1.2-19.
Affected products
- ImageMagick ImageMagick < 7.1.2-19
Timeline
- 2026-04-13: advisory: GitHub Security Advisory published
- 2026-07-08: disclosed: CVE published to NVD
- 2026-07-08: patched: Fix confirmed in version 7.1.2-19