GHSA-w54j-7wpm-crhj | Mondoo Vulnerability Intelligence

GHSA-w54j-7wpm-crhj

LOW3.3

ImageMagick has a heap-buffer-overflow in FTXT encoder

Published Apr 14, 2026

Modified 1 weeks ago

Fix available

Details

The FTXT encoder lacks a boundary check when parsing ftxt:format, resulting in an out of bounds read.

==3040863==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x5020000085b2 at pc 0x606c1ee0c6ce bp 0x7ffee30d6150 sp 0x7ffee30d6148
READ of size 1 at 0x5020000085b2 thread T0

Affected Packages(18 packages)

Magick.NET-Q16-AnyCPU

NuGet

Fixed in:

14.12.0

Magick.NET-Q16-HDRI-AnyCPU

NuGet

Fixed in:

14.12.0

Magick.NET-Q16-HDRI-OpenMP-arm64

NuGet

Fixed in:

14.12.0

Magick.NET-Q16-HDRI-OpenMP-x64

NuGet

Fixed in:

14.12.0

Magick.NET-Q16-HDRI-arm64

NuGet

Fixed in:

14.12.0

Magick.NET-Q16-HDRI-x64

NuGet

Fixed in:

14.12.0

Magick.NET-Q16-HDRI-x86

NuGet

Fixed in:

14.12.0

Magick.NET-Q16-OpenMP-arm64

NuGet

Fixed in:

14.12.0

Magick.NET-Q16-OpenMP-x64

NuGet

Fixed in:

14.12.0

Magick.NET-Q16-arm64

NuGet

Fixed in:

14.12.0

References

PACKAGE

https://github.com/ImageMagick/ImageMagick

WEB

https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-w54j-7wpm-crhj

ADVISORY

https://github.com/advisories/GHSA-w54j-7wpm-crhj

CVSS Analysis

CVSS v3.1

3.3

Exploitability

Attack Vector

LocalAV:L

Attack Complexity

LowAC:L

Privileges Required

NonePR:N

User Interaction

RequiredUI:R

Scope

UnchangedS:U

Impact

Confidentiality

NoneC:N

Integrity

NoneI:N

Availability

LowA:L

3.3/CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L

Ecosystems

NuGet

Timeline

PublishedApr 14, 2026

ModifiedApr 16, 2026