ImageMagick up to 7.1.2-14 FTXT Image Parser stack-based overflow

Summaryinfo

A vulnerability labeled as critical has been found in ImageMagick up to 7.1.2-14. This affects an unknown function of the component FTXT Image Parser. Executing a manipulation can lead to stack-based overflow. This vulnerability is handled as CVE-2026-25967. The attack can be executed remotely. There is not any exploit available. The affected component should be upgraded.

Detailsinfo

A vulnerability has been found in ImageMagick up to 7.1.2-14 and classified as critical. This vulnerability affects an unknown part of the component FTXT Image Parser. The manipulation with an unknown input leads to a stack-based overflow vulnerability. The CWE definition for the vulnerability is CWE-121. A stack-based buffer overflow condition is a condition where the buffer being overwritten is allocated on the stack (i.e., is a local variable or, rarely, a parameter to a function). As an impact it is known to affect confidentiality, integrity, and availability. CVE summarizes:

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to version 7.1.2-15, a stack-based buffer overflow exists in the ImageMagick FTXT image reader. A crafted FTXT file can cause out-of-bounds writes on the stack, leading to a crash. Version 7.1.2-15 contains a patch.

The advisory is shared for download at github.com. This vulnerability was named CVE-2026-25967 since 02/09/2026. The exploitation appears to be difficult. The attack can be initiated remotely. No form of authentication is required for a successful exploitation. Successful exploitation requires user interaction by the victim. There are neither technical details nor an exploit publicly available.

The vulnerability scanner Nessus provides a plugin with the ID 300032 (Linux Distros Unpatched Vulnerability : CVE-2026-25967), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 7.1.2-15 eliminates this vulnerability.

The vulnerability is also documented in the databases at Tenable (300032) and CERT Bund (WID-SEC-2026-0484). Once again VulDB remains the best source for vulnerability data.

Affected

• Debian Linux
• Amazon Linux 2
• Red Hat Enterprise Linux
• Ubuntu Linux
• SUSE Linux
• Oracle Linux
• SUSE openSUSE
• Open Source ImageMagick

Productinfo

Type

• Image Processing Software

Name

• ImageMagick

Version

• 7.1.2-14

License

• open-source

Website

• Product: https://www.imagemagick.org/

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion