Monitor vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
7.4
ImageMagick Image Editor Crashes with Malformed Image File
CVE-2026-25967
GHSA-72hf-fj62-w6j4
CVE-2026-25967
Summary
A security issue in older versions of ImageMagick can cause the software to crash when processing a specially crafted image file. This could potentially allow an attacker to disrupt service. Update to version 7.1.2-15 or later to fix the issue.
What to do
- Update magick.net-q16-anycpu to version 14.10.3.
- Update magick.net-q16-hdri-anycpu to version 14.10.3.
- Update magick.net-q16-hdri-openmp-arm64 to version 14.10.3.
- Update magick.net-q16-hdri-openmp-x64 to version 14.10.3.
- Update magick.net-q16-hdri-arm64 to version 14.10.3.
- Update magick.net-q16-hdri-x64 to version 14.10.3.
- Update magick.net-q16-hdri-x86 to version 14.10.3.
- Update magick.net-q16-openmp-arm64 to version 14.10.3.
- Update magick.net-q16-openmp-x64 to version 14.10.3.
- Update magick.net-q16-openmp-x86 to version 14.10.3.
- Update magick.net-q16-arm64 to version 14.10.3.
- Update magick.net-q16-x64 to version 14.10.3.
- Update magick.net-q16-x86 to version 14.10.3.
- Update magick.net-q8-anycpu to version 14.10.3.
- Update magick.net-q8-openmp-arm64 to version 14.10.3.
- Update magick.net-q8-arm64 to version 14.10.3.
- Update agick.net-q8-x64 to version 14.10.3.
- Update magick.net-q8-x86 to version 14.10.3.
Affected software
| Vendor | Product | Affected versions | Fix available |
|---|---|---|---|
| – | magick.net-q16-anycpu | <= 14.10.3 | 14.10.3 |
| – | magick.net-q16-hdri-anycpu | <= 14.10.3 | 14.10.3 |
| – | magick.net-q16-hdri-openmp-arm64 | <= 14.10.3 | 14.10.3 |
| – | magick.net-q16-hdri-openmp-x64 | <= 14.10.3 | 14.10.3 |
| – | magick.net-q16-hdri-arm64 | <= 14.10.3 | 14.10.3 |
| – | magick.net-q16-hdri-x64 | <= 14.10.3 | 14.10.3 |
| – | magick.net-q16-hdri-x86 | <= 14.10.3 | 14.10.3 |
| – | magick.net-q16-openmp-arm64 | <= 14.10.3 | 14.10.3 |
| – | magick.net-q16-openmp-x64 | <= 14.10.3 | 14.10.3 |
| – | magick.net-q16-openmp-x86 | <= 14.10.3 | 14.10.3 |
| – | magick.net-q16-arm64 | <= 14.10.3 | 14.10.3 |
| – | magick.net-q16-x64 | <= 14.10.3 | 14.10.3 |
| – | magick.net-q16-x86 | <= 14.10.3 | 14.10.3 |
| – | magick.net-q8-anycpu | <= 14.10.3 | 14.10.3 |
| – | magick.net-q8-openmp-arm64 | <= 14.10.3 | 14.10.3 |
| – | magick.net-q8-arm64 | <= 14.10.3 | 14.10.3 |
| – | agick.net-q8-x64 | <= 14.10.3 | 14.10.3 |
| – | magick.net-q8-x86 | <= 14.10.3 | 14.10.3 |
| imagemagick | imagemagick | <= 6.9.13-40 | – |
| imagemagick | imagemagick | > 7.0.0-0 , <= 7.1.2-15 | – |
Original title
ImageMagick has stack buffer overflow in FTXT reader via oversized integer field
Original description
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to version 7.1.2-15, a stack-based buffer overflow exists in the ImageMagick FTXT image reader. A crafted FTXT file can cause out-of-bounds writes on the stack, leading to a crash. Version 7.1.2-15 contains a patch.
nvd CVSS3.1
7.5
Vulnerability type
CWE-121
Stack-based Buffer Overflow
CWE-787
Out-of-bounds Write
- https://nvd.nist.gov/vuln/detail/CVE-2026-25967
- https://github.com/ImageMagick/ImageMagick/commit/9afe96cc325da1e4349fbd7418675a...
- https://github.com/dlemstra/Magick.NET/releases/tag/14.10.3
- https://github.com/advisories/GHSA-72hf-fj62-w6j4
- https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-72hf-fj62-w6... Third Party Advisory
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/25xxx/CVE-2026-25967... Vendor Advisory
Published: 24 Feb 2026 · Updated: 12 Mar 2026 · First seen: 6 Mar 2026