CVE-2026-56374: ImageMagick Buffer Overflow Vulnerability

CVE-2026-56374 Overview

CVE-2026-56374 is a heap buffer overflow vulnerability in ImageMagick versions prior to 7.1.2-19. The flaw exists in the FTXT encoder, where missing boundary checks during parsing of the ftxt:format parameter allow an out-of-bounds read. Attackers can trigger the condition by supplying a crafted FTXT image file to a vulnerable ImageMagick process. Successful exploitation can lead to denial of service or disclosure of adjacent heap memory contents. The issue is tracked under [CWE-125] Out-of-Bounds Read and is documented in the ImageMagick GitHub Security Advisory.

Critical Impact
Processing a malicious FTXT file can leak heap memory contents or crash the ImageMagick process, affecting any application or service that passes untrusted images through ImageMagick.

Affected Products

ImageMagick versions before 7.1.2-19
Applications and services embedding vulnerable ImageMagick builds
Image processing pipelines that accept FTXT-format input

Discovery Timeline

2026-07-08 - CVE-2026-56374 published to NVD
2026-07-09 - Last updated in NVD database

Technical Details for CVE-2026-56374

Vulnerability Analysis

The vulnerability resides in ImageMagick's FTXT coder, which parses text-formatted image representations. When the encoder processes the ftxt:format parameter, it fails to validate buffer boundaries before reading input data. This missing check allows the parser to read beyond the intended heap allocation. The result is an out-of-bounds read that may return uninitialized or adjacent heap memory to the caller. Depending on where the invalid read lands, the process may crash or emit memory contents through error messages, image output, or logs. Exploitation requires the victim to process an attacker-supplied FTXT file, which is common in web upload pipelines and thumbnail generators.

Root Cause

The root cause is insufficient input validation in the FTXT format-parsing routine. The encoder trusts the size and structure declared in the ftxt:format parameter without verifying it against the allocated buffer length. Under CWE-125, the code reads past the end of an object, producing undefined behavior on the heap.

Attack Vector

The attack vector is local file processing with user interaction required. An attacker crafts a malicious FTXT file and delivers it to a system running vulnerable ImageMagick. When the file is opened, converted, or identified by ImageMagick, the FTXT encoder triggers the out-of-bounds read. Automated conversion pipelines, content management systems, and document processors expand this local vector into a network-reachable path.

No verified public proof-of-concept code is available. Refer to the VulnCheck Advisory on ImageMagick for further technical detail.

Detection Methods for CVE-2026-56374

Indicators of Compromise

ImageMagick processes crashing with segmentation faults while handling FTXT input
Unexpected .ftxt files uploaded to image processing endpoints
ImageMagick log entries referencing errors in the FTXT coder or ftxt:format parameter
Abnormal memory disclosure in image conversion output or error responses

Detection Strategies

Inventory ImageMagick installations and flag versions earlier than 7.1.2-19
Inspect application logs for convert, magick, or identify invocations referencing FTXT
Monitor for repeated crashes of magick or convert binaries in short time windows
Alert on ingestion of FTXT files where the pipeline expects standard image formats

Monitoring Recommendations

Enable core dump collection on hosts running ImageMagick to capture crash artifacts
Forward ImageMagick and web server logs to a central SIEM for correlation
Track outbound responses from image endpoints for anomalously large or binary-tainted payloads

How to Mitigate CVE-2026-56374

Immediate Actions Required

Upgrade ImageMagick to version 7.1.2-19 or later on all systems
Audit third-party applications and container images for embedded ImageMagick binaries
Restrict accepted image formats at the application layer to exclude FTXT unless required
Run ImageMagick with least-privilege service accounts and process isolation

Patch Information

The fix is available in ImageMagick 7.1.2-19 and later. See the ImageMagick GitHub Security Advisory GHSA-w54j-7wpm-crhj for the authoritative patch details and commit references.

Workarounds

Disable the FTXT coder in policy.xml if patching is not immediately possible
Enforce input MIME-type and extension allowlists before invoking ImageMagick
Sandbox ImageMagick with seccomp, AppArmor, or containers to limit blast radius
Rate-limit image conversion endpoints to reduce impact of repeated crash attempts

bash

# Example: disable the FTXT coder in ImageMagick policy.xml
# Add the following inside the <policymap> element
<policy domain="coder" rights="none" pattern="FTXT" />