Junglewise Threat Intelligence

ImageMagick heap buffer overflow in FTXT encoder

Severity: low · CVSS 3.3 · Published 2026-04-14

Technologies: Magick.NET-Q16-OpenMP-arm64 (NuGet), Magick.NET-Q16-AnyCPU (NuGet), Magick.NET-Q16-HDRI-AnyCPU (NuGet), Magick.NET-Q8-x86 (NuGet), Magick.NET-Q8-AnyCPU (NuGet), Magick.NET-Q16-arm64 (NuGet), Magick.NET-Q16-OpenMP-x64 (NuGet), Magick.NET-Q16-HDRI-OpenMP-x64 (NuGet), Magick.NET-Q16-HDRI-arm64 (NuGet), Magick.NET-Q16-HDRI-x86 (NuGet), Magick.NET-Q16-HDRI-x64 (NuGet), Magick.NET-Q8-OpenMP-arm64 (NuGet), Magick.NET-Q8-OpenMP-x64 (NuGet), Magick.NET-Q16-x64 (NuGet), Magick.NET-Q8-arm64 (NuGet), Magick.NET-Q8-x64 (NuGet), Magick.NET-Q16-x86 (NuGet), Magick.NET-Q16-HDRI-OpenMP-arm64 (NuGet). Vendors: ImageMagick, NuGet.

Executive brief

ImageMagick, a widely used software suite for displaying and converting images, contains a flaw in how it processes certain formatted text files. An attacker could potentially cause the application to crash by providing a specially crafted file. This primarily impacts the reliability and availability of services that use ImageMagick to process user-uploaded content.

Technical details

An out-of-bounds read vulnerability (CWE-125) exists in the ImageMagick FTXT encoder. The root cause is a missing boundary check during the parsing of the 'ftxt:format' attribute. A local attacker can exploit this by providing a malicious file that triggers a heap-buffer-overflow when processed. While the impact is primarily limited to a denial-of-service (crash) due to the out-of-bounds read, it highlights a memory safety issue in the image processing pipeline. The vulnerability is addressed in Magick.NET version 14.12.0.

Affected products

  • ImageMagick Magick.NET-Q16-AnyCPU < 14.12.0
  • ImageMagick Magick.NET-Q16-HDRI-AnyCPU < 14.12.0
  • ImageMagick Magick.NET-Q16-HDRI-OpenMP-arm64 < 14.12.0
  • ImageMagick Magick.NET-Q16-HDRI-OpenMP-x64 < 14.12.0
  • ImageMagick Magick.NET-Q16-HDRI-arm64 < 14.12.0
  • ImageMagick Magick.NET-Q16-HDRI-x64 < 14.12.0
  • ImageMagick Magick.NET-Q16-HDRI-x86 < 14.12.0
  • ImageMagick Magick.NET-Q16-OpenMP-arm64 < 14.12.0
  • ImageMagick Magick.NET-Q16-OpenMP-x64 < 14.12.0
  • ImageMagick Magick.NET-Q16-arm64 < 14.12.0
  • ImageMagick Magick.NET-Q16-x64 < 14.12.0
  • ImageMagick Magick.NET-Q16-x86 < 14.12.0
  • ImageMagick Magick.NET-Q8-AnyCPU < 14.12.0
  • ImageMagick Magick.NET-Q8-OpenMP-arm64 < 14.12.0
  • ImageMagick Magick.NET-Q8-OpenMP-x64 < 14.12.0
  • ImageMagick Magick.NET-Q8-arm64 < 14.12.0
  • ImageMagick Magick.NET-Q8-x64 < 14.12.0
  • ImageMagick Magick.NET-Q8-x86 < 14.12.0

Timeline

  • 2026-04-13: disclosed
  • 2026-04-14: advisory

References

Related threats