ImageMagick CVE-2026-56374

Exploitation requires that a victim user or automated process opens or processes an attacker-controlled FTXT image file using a vulnerable ImageMagick version (before 7.1.2-19). The CVSS vector specifies UI:P (passive user interaction or operator-initiated processing), meaning the file must be actively processed - it cannot be triggered remotely without this step. For server-side pipelines that automatically process uploaded images, the 'user interaction' barrier is effectively absent since the server itself fulfills that role. No authentication is required (PR:N) to submit the file if the receiving application accepts uploads. Exploitation is limited to the local system running ImageMagick (AV:L), meaning impact is contained to that process and its memory. The FTXT format is a less common format, so deployments that do not process FTXT files (or block unknown coders via policy.xml) are not at risk from this specific vector.

The CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L) scores 4.8, indicating a low-to-medium severity with local attack vector and required user interaction. A notable tension exists between the description's framing of 'remote attackers' and the CVSS AV:L designation - the most likely reconciliation is that the file must be opened or processed locally, but delivery of the malicious file can be remote (e.g., via email or upload). The CVSS VC:N (no confidentiality impact) conflicts with the description's explicit mention of 'information disclosure,' and with the nature of CWE-125 which inherently risks memory leakage; this discrepancy should be verified against the vendor advisory. Availability impact is rated Low (VA:L), suggesting controlled crash rather than persistent DoS. No EPSS data was provided, no KEV listing, and no POC has been identified, placing real-world exploitation risk at low probability absent additional threat intelligence. The primary risk concern is in automated image processing pipelines where untrusted files are ingested without interaction, making the UI:P constraint weaker in practice for server-side deployments.

An attacker crafts a malicious FTXT image file with a specially structured ftxt:format value designed to trigger the out-of-bounds read in the FTXT encoder. The file is delivered to a target - for example, uploaded to a web application that uses ImageMagick for thumbnail generation or format conversion - and when the server processes the file, the missing boundary check causes a heap read beyond the allocated buffer, crashing the ImageMagick worker process or leaking heap memory contents. No public exploit code has been identified at time of analysis, but the primitives (crafted image triggering OOB read) are straightforward to develop given the advisory details.