ImageMagick releases a memory allocation when processing TXT files that contain a texture attribute. If the ReadImage function succeeds but the subsequent GetTypeMetrics call fails, the texture object that was allocated is never freed, leading to progressively leaked memory for every such file processed. This leak does not expose sensitive data directly, but repeated use of crafted TXT files can exhaust system memory and cause application or system instability.

The vulnerability affects ImageMagick releases older than version 7.1.2‑15 and 6.9.13‑40. All installations of the ImageMagick software suite should verify their version and apply an update where available.

Because the leak occurs during normal file parsing, an attacker must supply or force the processing of malicious TXT files. No privileged code execution or direct data disclosure is required. The exploit likelihood is uncertain due to lack of EPSS data, and the defect is not listed in the CISA KEV catalog, suggesting no publicly available exploits yet. However, the potential to trigger a denial of service remains significant, especially on systems that routinely handle untrusted image and text input.