CVE-2026-25967
Stack-Based Buffer Overflow in ImageMagick FTXT Reader Causes Crash
Publication date: 2026-02-24
Last updated on: 2026-02-25
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| imagemagick | imagemagick | to 6.9.13-40 (exc) |
| imagemagick | imagemagick | From 7.0.0-0 (inc) to 7.1.2-15 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-121 | A stack-based buffer overflow condition is a condition where the buffer being overwritten is allocated on the stack (i.e., is a local variable or, rarely, a parameter to a function). |
| CWE-787 | The product writes data past the end, or before the beginning, of the intended buffer. |
Attack-Flow Graph
AI Powered Q&A
What immediate steps should I take to mitigate this vulnerability?
The immediate mitigation step is to upgrade ImageMagick to version 7.1.2-15 or later, where the vulnerability has been patched.
Until the upgrade is applied, avoid processing untrusted or crafted FTXT image files that could exploit this stack-based buffer overflow.
Implement monitoring for crashes or abnormal behavior in ImageMagick processes to detect potential exploitation attempts.
Can you explain this vulnerability to me?
CVE-2026-25967 is a high-severity stack-based buffer overflow vulnerability in the ImageMagick FTXT image reader affecting versions prior to 7.1.2-15.
The flaw occurs because the software improperly handles an oversized integer field in a specially crafted FTXT file, which causes out-of-bounds writes on the stack.
This leads to a crash of the program due to overwriting memory beyond the allocated stack buffer.
The vulnerability was detected using AddressSanitizer and is classified as CWE-121 (stack-based buffer overflow).
How can this vulnerability impact me? :
This vulnerability can be exploited remotely over a network without requiring privileges or user interaction.
While it does not impact confidentiality, it has high impact on integrity and availability, meaning an attacker can cause the ImageMagick process to crash or behave unpredictably.
Such crashes or instability could be used to disrupt services that rely on ImageMagick for image processing.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by monitoring for crashes or abnormal behavior when processing FTXT image files with vulnerable versions of ImageMagick prior to 7.1.2-15.
Detection was originally performed using AddressSanitizer, which identifies stack-buffer-overflow errors during write operations.
To detect if your system is vulnerable, you can check the installed ImageMagick version with the command:
- magick -version
If the version is earlier than 7.1.2-15, your system is vulnerable.
Additionally, you can attempt to process suspicious or crafted FTXT files in a controlled environment to observe if crashes or stack-buffer-overflow errors occur.