ImageMagick has stack buffer overflow in FTXT reader via oversized integer field

Vulnerability

Overview

A stack-based buffer overflow vulnerability exists in the FTXT image reader of ImageMagick, a widely used open-source image processing suite [1]. The flaw, present in versions prior to 7.1.2-15, is triggered when processing a specially crafted FTXT file. The root cause is an oversized integer field that leads to out-of-bounds writes on the stack [4].

Exploitation

An attacker can exploit this vulnerability by providing a malicious FTXT file to an application or service that uses ImageMagick to process images. No authentication is required; the attack vector is local or remote if the application accepts user-supplied images. The crafted file causes the FTXT reader to write beyond the allocated stack buffer, as demonstrated by an AddressSanitizer stack-buffer-overflow error [4].

Impact

Successful exploitation results in a crash of the ImageMagick process, leading to a denial of service (DoS). The vulnerability does not appear to allow arbitrary code execution based on the available information, but the out-of-bounds write could potentially be leveraged for more severe impacts in certain configurations [2][4].

Mitigation

The vulnerability is patched in ImageMagick version 7.1.2-15 [2][4]. Users should update to this version or later. The issue is tracked as GHSA-72hf-fj62-w6j4 and is also addressed in downstream libraries such as Magick.NET 14.10.3 [3]. No workarounds are documented; upgrading is the recommended action.