Executive brief
ImageMagick, a widely used software suite for displaying and converting images, contains a flaw in how it processes certain formatted text files. An attacker could potentially cause the application to crash by providing a specially crafted file. This primarily impacts the reliability and availability of services that use ImageMagick to process user-uploaded content.
Technical details
An out-of-bounds read vulnerability (CWE-125) exists in the ImageMagick FTXT encoder. The root cause is a missing boundary check during the parsing of the 'ftxt:format' attribute. A local attacker can exploit this by providing a malicious file that triggers a heap-buffer-overflow when processed. While the impact is primarily limited to a denial-of-service (crash) due to the out-of-bounds read, it highlights a memory safety issue in the image processing pipeline. The vulnerability is addressed in Magick.NET version 14.12.0.
Affected products
- ImageMagick Magick.NET-Q16-AnyCPU < 14.12.0
- ImageMagick Magick.NET-Q16-HDRI-AnyCPU < 14.12.0
- ImageMagick Magick.NET-Q16-HDRI-OpenMP-arm64 < 14.12.0
- ImageMagick Magick.NET-Q16-HDRI-OpenMP-x64 < 14.12.0
- ImageMagick Magick.NET-Q16-HDRI-arm64 < 14.12.0
- ImageMagick Magick.NET-Q16-HDRI-x64 < 14.12.0
- ImageMagick Magick.NET-Q16-HDRI-x86 < 14.12.0
- ImageMagick Magick.NET-Q16-OpenMP-arm64 < 14.12.0
- ImageMagick Magick.NET-Q16-OpenMP-x64 < 14.12.0
- ImageMagick Magick.NET-Q16-arm64 < 14.12.0
- ImageMagick Magick.NET-Q16-x64 < 14.12.0
- ImageMagick Magick.NET-Q16-x86 < 14.12.0
- ImageMagick Magick.NET-Q8-AnyCPU < 14.12.0
- ImageMagick Magick.NET-Q8-OpenMP-arm64 < 14.12.0
- ImageMagick Magick.NET-Q8-OpenMP-x64 < 14.12.0
- ImageMagick Magick.NET-Q8-arm64 < 14.12.0
- ImageMagick Magick.NET-Q8-x64 < 14.12.0
- ImageMagick Magick.NET-Q8-x86 < 14.12.0
Timeline
- 2026-04-13: disclosed
- 2026-04-14: advisory