CVE-2026-25967: 
C# vulnerability analysis and mitigation

CVE-2026-25967 is a stack-based buffer overflow vulnerability in the ImageMagick FTXT image reader, triggered by processing a crafted FTXT file that causes out-of-bounds writes on the stack, leading to a crash. It affects ImageMagick versions prior to 7.1.2-15 (7.x series) and prior to 6.9.13-40 (6.x series), as well as Magick.NET NuGet packages prior to version 14.10.3. The vulnerability was published on February 23–24, 2026, with a patch released in ImageMagick 7.1.2-15. It carries a CVSS v3.1 base score of 7.4 (High) per the GitHub Security Advisory (GitHub Advisory, Red Hat Bugzilla).

The root cause is a stack-based buffer overflow (CWE-121) in ImageMagick's FTXT image reader, compounded by an integer overflow or wraparound (CWE-190) that leads to an out-of-bounds write (CWE-787). Specifically, an oversized integer field in a crafted FTXT file causes the reader to write beyond the bounds of a stack-allocated buffer, as confirmed by AddressSanitizer output showing a WRITE of size 1 at an out-of-bounds stack address. The attack vector is network-based with high attack complexity, requiring no privileges or user interaction — an attacker must be able to supply a malicious FTXT file to a system that processes it with ImageMagick. The vulnerability was reported by researcher ylwango613 and the fix is available in commit 9afe96c of the ImageMagick repository (GitHub Advisory, Github Advisory).

Successful exploitation causes an application crash (denial of service) due to the stack-based buffer overflow, with high availability impact. The out-of-bounds stack write also carries a high integrity impact, as arbitrary data may be written to stack memory, potentially corrupting program state. Confidentiality is not directly impacted. Systems that automatically process user-supplied image files — such as web applications, media pipelines, or document converters using ImageMagick — are at greatest risk (GitHub Advisory, Red Hat Bugzilla).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of disclosure (Github Advisory). The EPSS score is approximately 0.019% (5th percentile), indicating a low near-term probability of exploitation. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported.

1. Craft a malicious FTXT file: Construct an FTXT image file containing an oversized integer field in the relevant header or data section that triggers the integer overflow in ImageMagick's FTXT reader, causing it to calculate an undersized buffer allocation.
2. Deliver the file to the target: Upload or submit the crafted FTXT file to any service or application that processes images using a vulnerable version of ImageMagick (prior to 7.1.2-15), such as a web-based image upload endpoint, a media conversion API, or a document processing pipeline.
3. Trigger processing: Cause the target application to invoke ImageMagick to read or convert the malicious FTXT file (e.g., via convert malicious.ftxt output.png).
4. Achieve out-of-bounds write: The FTXT reader writes beyond the stack buffer boundary, corrupting adjacent stack memory and causing a crash (denial of service). Depending on memory layout and stack protections, this could potentially be leveraged for further exploitation (GitHub Advisory).

• Logs: Application or system logs showing ImageMagick crashes or segmentation faults when processing FTXT files; AddressSanitizer output referencing stack-buffer-overflow in the FTXT reader code path.
• Process: Unexpected termination of ImageMagick processes (convert, magick) with signal 11 (SIGSEGV) or signal 6 (SIGABRT) shortly after receiving or processing an FTXT file.
• File System: Presence of unusual or unexpected .ftxt files in upload directories, temporary processing directories, or image input queues.
• Network: Inbound submissions of files with .ftxt extensions or FTXT magic bytes to image processing endpoints, particularly from untrusted or external sources.

Upgrade ImageMagick to version 7.1.2-15 or later (6.x users should upgrade to 6.9.13-40 or later). For .NET applications using Magick.NET, upgrade all affected NuGet packages to version 14.10.3 or later. As an interim workaround, restrict or disable processing of FTXT image files using ImageMagick's policy configuration (/etc/ImageMagick-*/policy.xml) by adding a deny rule for the FTXT format, and implement input validation and sandboxing for all image processing operations that accept user-supplied files (GitHub Advisory, Github Advisory).

Red Hat tracked the vulnerability via Bugzilla (Bug 2442126) and classified it as medium severity for their products. openSUSE and Debian issued security advisories and package updates addressing CVE-2026-25967 among other ImageMagick issues. Tenable published multiple Nessus detection plugins for the vulnerability. Coverage was limited to routine security update announcements with no notable researcher commentary or significant social media discussion (Red Hat Bugzilla).