CVE-2026-56374
LowCVSS 3.3Exploitation Probability (EPSS)
Low risk4th percentile - higher than 4% of all known CVEs
Summary
A heap buffer overflow vulnerability in ImageMagick before 7.1.2-19 exists in the FTXT encoder due to missing boundary checks when parsing ftxt:format. Remote attackers can trigger an out-of-bounds read by crafting malicious FTXT image files, leading to denial of service or information disclosure.
Risk Assessment
The organization faces risks of denial of service and sensitive data leakage through remote processing of malicious FTXT files. The vulnerability can be exploited without authentication, increasing risk for image-processing systems.
Recommendation
Immediately upgrade ImageMagick to version 7.1.2-19 or later. As a workaround, block processing of FTXT files on trusted systems.
Original NVD description (English source)
ImageMagick before 7.1.2-19 contains a heap buffer overflow vulnerability in the FTXT encoder due to missing boundary checks when parsing ftxt:format. Remote attackers can trigger an out of bounds read by crafting malicious FTXT image files to cause denial of service or information disclosure.