CVE-2026-25967

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-25967", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-02-09T17:13:54.067Z", "datePublished": "2026-02-24T01:29:44.758Z", "dateUpdated": "2026-06-23T15:48:18.218Z"}, "containers": {"cna": {"title": "ImageMagick has stack buffer overflow in FTXT reader via oversized integer field", "problemTypes": [{"descriptions": [{"cweId": "CWE-121", "lang": "en", "description": "CWE-121: Stack-based Buffer Overflow", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.4, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-72hf-fj62-w6j4", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-72hf-fj62-w6j4"}], "affected": [{"vendor": "ImageMagick", "product": "ImageMagick", "versions": [{"version": "< 7.1.2-15", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-02-24T01:29:44.758Z"}, "descriptions": [{"lang": "en", "value": "ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to version 7.1.2-15, a stack-based buffer overflow exists in the ImageMagick FTXT image reader. A crafted FTXT file can cause out-of-bounds writes on the stack, leading to a crash. Version 7.1.2-15 contains a patch."}], "source": {"advisory": "GHSA-72hf-fj62-w6j4", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-02-26T21:02:25.956008Z", "id": "CVE-2026-25967", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-23T15:48:18.218Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-25967", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-02-26T21:02:25.956008Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-26T21:02:27.504Z"}}], "cna": {"title": "ImageMagick has stack buffer overflow in FTXT reader via oversized integer field", "source": {"advisory": "GHSA-72hf-fj62-w6j4", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.4, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}], "affected": [{"vendor": "ImageMagick", "product": "ImageMagick", "versions": [{"status": "affected", "version": "< 7.1.2-15"}]}], "references": [{"url": "https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-72hf-fj62-w6j4", "name": "https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-72hf-fj62-w6j4", "tags": ["x_refsource_CONFIRM"]}], "descriptions": [{"lang": "en", "value": "ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to version 7.1.2-15, a stack-based buffer overflow exists in the ImageMagick FTXT image reader. A crafted FTXT file can cause out-of-bounds writes on the stack, leading to a crash. Version 7.1.2-15 contains a patch."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-121", "description": "CWE-121: Stack-based Buffer Overflow"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-02-24T01:29:44.758Z"}}}, "cveMetadata": {"cveId": "CVE-2026-25967", "state": "PUBLISHED", "dateUpdated": "2026-06-23T15:48:18.218Z", "dateReserved": "2026-02-09T17:13:54.067Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-02-24T01:29:44.758Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "ImageMagick", "vendor": "ImageMagick", "versions": [{"status": "affected", "version": "< 7.1.2-15"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:imagemagick:imagemagick:*:*:*:*:*:*:*:*", "matchCriteriaId": "C6F44A65-1733-4752-AAD0-BCCC7BDBC877", "versionEndExcluding": "6.9.13-40", "vulnerable": true}, {"criteria": "cpe:2.3:a:imagemagick:imagemagick:*:*:*:*:*:*:*:*", "matchCriteriaId": "6AFFD439-1068-4B6F-AE01-724AC62CDCEA", "versionEndExcluding": "7.1.2-15", "versionStartIncluding": "7.0.0-0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to version 7.1.2-15, a stack-based buffer overflow exists in the ImageMagick FTXT image reader. A crafted FTXT file can cause out-of-bounds writes on the stack, leading to a crash. Version 7.1.2-15 contains a patch."}, {"lang": "es", "value": "ImageMagick es un software libre y de c\u00f3digo abierto utilizado para editar y manipular im\u00e1genes digitales. Antes de la versi\u00f3n 7.1.2-15, existe un desbordamiento de b\u00fafer basado en pila en el lector de im\u00e1genes FTXT de ImageMagick. Un archivo FTXT manipulado puede causar escrituras fuera de los l\u00edmites en la pila, lo que lleva a un fallo. La versi\u00f3n 7.1.2-15 contiene un parche."}], "id": "CVE-2026-25967", "lastModified": "2026-06-17T10:25:30.610", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.4, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.2, "impactScore": 5.2, "source": "security-advisories@github.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-25967", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-02-26T21:02:25.956008Z", "version": "2.0.3"}}]}, "published": "2026-02-24T02:16:01.483", "references": [{"source": "security-advisories@github.com", "tags": ["Third Party Advisory"], "url": "https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-72hf-fj62-w6j4"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-121"}], "source": "security-advisories@github.com", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-787"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "ImageMagick: ImageMagick: Denial of Service via crafted FTXT file", "id": "2442126", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2442126"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.4", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H", "status": "draft"}, "cwe": "CWE-190", "details": ["A flaw was found in ImageMagick. A remote attacker could exploit a stack-based buffer overflow vulnerability in the FTXT image reader. By providing a specially crafted FTXT file, an attacker could cause out-of-bounds writes on the stack, leading to a crash and resulting in a Denial of Service (DoS)."], "mitigation": {"lang": "en:us", "value": "To mitigate this issue, avoid processing untrusted FTXT image files with ImageMagick. If ImageMagick must process untrusted input, consider running the application in a sandboxed environment to limit potential impact."}, "name": "CVE-2026-25967", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Out of support scope", "package_name": "ImageMagick", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Out of support scope", "package_name": "ImageMagick", "product_name": "Red Hat Enterprise Linux 7"}], "public_date": "2026-02-24T01:29:44Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-25967\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-25967\nhttps://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-72hf-fj62-w6j4"], "statement": "This MODERATE impact flaw in ImageMagick allows a remote attacker to cause a denial of service by providing a specially crafted FTXT file. The vulnerability, a stack-based buffer overflow in the FTXT image reader, can lead to out-of-bounds writes and application crashes. This affects ImageMagick as shipped in Red Hat Enterprise Linux 6 ELS and 7 ELS.", "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,7.1.2-15)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "ImageMagick", "source": "cna", "vendor": "ImageMagick"}, "product": "imagemagick", "vendor": "imagemagick"}], "analysis": {"en": {"generated_at": "2026-04-17T16:00:03.572965+00:00", "value": {"mitigation_remediation": ["Upgrade all ImageMagick instances to version 7.1.2\u201115 or newer, which contains the fixed FTXT reader.", "Configure the image processing subsystem to reject or ignore files with the .FTXT extension if the format is not required, thereby removing the vulnerable code path.", "Apply additional file validation or sandboxing around image parsing routines to ensure that malformed FTXT files are not executed against privileged processes."], "summary": {"action": "Apply Patch", "impact": "Denial of Service"}, "threat_synthesis": {"affected_systems": "The flaw affects installations of ImageMagick, specifically all releases before 7.1.2\u201115. Any system that uses the ImageMagick library to read FTXT files, such as web servers, document processors, or media applications, may be impacted when provided with a malicious file. Versions 7.1.2\u201115 and later include the patch that resolves the overflow.", "description_and_impact": "ImageMagick contains a stack-based buffer overflow in the FTXT image reader that allows out\u2011of\u2011bounds writes to the stack when processing a crafted file. The flaw is triggered by an oversized integer field in the file header and results in a program crash; while the description does not confirm arbitrary code execution, the nature of the overflow could permit it if an attacker can control the payload. This vulnerability corresponds to several common weaknesses: stack corruption (CWE\u2011121), unsigned integer overflow (CWE\u2011190), and buffer overread/write (CWE\u2011787).", "risk_and_exploitability": "The CVSS score of 7.4 marks this vulnerability as moderately severe. Its EPSS probability is below 1%, suggesting that, as of now, the volume of exploitation in the wild is very low. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. An attacker would need to supply a crafted FTXT file to the ImageMagick library, which could be achieved through file uploads, email attachments, or other import mechanisms. Once processed, the crash could lead to denial of service, and if the attacker achieves control over the stack, arbitrary code execution is possible, though no public exploits have been documented."}}}}, "created": "2026-02-24T09:53:59.182419+00:00", "updated": "2026-04-17T16:00:11.400948+00:00", "vendors": ["imagemagick", "imagemagick$PRODUCT$imagemagick"]}