CVE-2026-56371

ImageMagick releases a private object when reading a TXT image file that contains a texture attribute. If the subsequent GetTypeMetrics call fails, that object is never freed, causing the process to leak memory each time the file is parsed. The leak does not disclose or modify data; it simply consumes available RAM, which over repeated usage can exhaust system memory, destabilize the application and potentially affect the host operating system.

All installations of the ImageMagick image processing suite with releases older than 7.1.2‑15 in the 7.x branch or older than 6.9.13‑40 in the 6.x branch. These versions are affected by the memory‑leak flaw when processing TXT files that include texture attributes.

The vulnerability can be exploited by forcing the target system to parse crafted TXT files containing a texture attribute. Based on the description, the likely attack vector involves supplying such a file to a service or application that uses ImageMagick to process untrusted image data. The EPSS score of <1 % suggests that publicly available, automated exploitation is currently unlikely, and the flaw is not listed in CISA’s KEV catalogue. Nevertheless, repetitive or batch processing of malicious files can lead to memory exhaustion, presenting a moderate to high risk of denial of service. The CVSS score of 6.9 reflects these conditions.