Copyright © 2012 Red Hat, Inc. All rights reserved. Low 2026-07-08T13:49:04 ImageMagick: ImageMagick: Denial of Service and Information Disclosure via heap buffer overflow in FTXT encoder 3.3 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L CWE-125

ImageMagick before 7.1.2-19 contains a heap buffer overflow vulnerability in the FTXT encoder due to missing boundary checks when parsing ftxt:format. Remote attackers can trigger an out of bounds read by crafting malicious FTXT image files to cause denial of service or information disclosure.

A heap buffer overflow vulnerability exists in ImageMagick and Magick.NET's FTXT encoder due to missing boundary checks for the ftxt:format parameter. A remote attacker could exploit this using a specially crafted FTXT image to cause a denial of service or disclose sensitive information.

This low-impact heap buffer overflow in ImageMagick's FTXT encoder, caused by insufficient boundary checks, could lead to denial of service or information disclosure if a user opens a specially crafted FTXT file. To mitigate this, disable the vulnerable FTXT format by adding the following line to your ImageMagick security policy file (typically /etc/ImageMagick-7/policy.xml): <policy domain="coder" rights="none" pattern="FTXT" /> Applying this mitigation will immediately block ImageMagick from processing any files in the FTXT format, but requires no service restarts or downtime. Red Hat Enterprise Linux 6 Out of support scope ImageMagick Red Hat Enterprise Linux 7 Out of support scope ImageMagick https://www.cve.org/CVERecord?id=CVE-2026-56374 https://nvd.nist.gov/vuln/detail/CVE-2026-56374 https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-w54j-7wpm-crhj https://www.vulncheck.com/advisories/imagemagick-heap-buffer-overflow-in-ftxt-encoder-via-format-parameter