CVE-2026-56374

A heap buffer overflow vulnerability exists in ImageMagick and Magick.NET's FTXT encoder due to missing boundary checks for the ftxt:format parameter. A remote attacker could exploit this using a specially crafted FTXT image to cause a denial of service or disclose sensitive information.

This low-impact heap buffer overflow in ImageMagick's FTXT encoder, caused by insufficient boundary checks, could lead to denial of service or information disclosure if a user opens a specially crafted FTXT file.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this, disable the vulnerable FTXT format by adding the following line to your ImageMagick security policy file (typically /etc/ImageMagick-7/policy.xml): <policy domain="coder" rights="none" pattern="FTXT" /> Applying this mitigation will immediately block ImageMagick from processing any files in the FTXT format, but requires no service restarts or downtime.