CVE-2026-56371: ImageMagick Memory Leak in TXT File Processing

Technical summary

The vulnerability exists in ImageMagick's coders/txt.c module. When processing TXT files containing texture attributes, the code path calls ReadImage to allocate a texture object. If the subsequent GetTypeMetrics function fails, the allocated texture object is not freed before returning from the function. This results in a classic use-after-free pattern where memory is allocated but never released. Each crafted TXT file processed leaks memory, eventually degrading service availability through resource exhaustion. Versions affected include ImageMagick before 7.1.2-15 and 6.9.13-40.

Business impact

Organizations deploying ImageMagick in web services, batch image processing pipelines, or document conversion workflows face availability risk. A remote attacker can cause progressive memory consumption by repeatedly submitting crafted TXT files, ultimately leading to process crashes or system-wide resource starvation. This is particularly concerning for SaaS platforms, content management systems, and automated image processing infrastructure that process user-supplied files without strict validation. The denial-of-service impact may disrupt critical business workflows and affect user-facing services.

Affected systems

ImageMagick versions prior to 7.1.2-15 in the 7.x branch and prior to 6.9.13-40 in the legacy 6.9.x branch are vulnerable. Any application or service that uses ImageMagick to process TXT files is at risk. This includes web applications accepting file uploads, document conversion services, image manipulation tools, and automated batch processing systems. The vulnerability requires no authentication and can be triggered remotely by providing a specially crafted TXT file.

Exploitability

Exploitability is moderate to high. The vulnerability requires no privileges, authentication, or user interaction—an attacker simply provides a crafted TXT file to a vulnerable ImageMagick instance. The attack is network-accessible and deterministic; each processed file leaks memory in a predictable way. However, weaponization requires knowledge of the vulnerable code path and the ability to submit files to the target service. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) reflects that while the attack is easy to perform, the impact is limited to availability and does not affect confidentiality or integrity. Exploitation does not appear in CISA's Known Exploited Vulnerabilities catalog.

Remediation

Upgrade ImageMagick to version 7.1.2-15 or later if using the 7.x branch, or to 6.9.13-40 or later if using the legacy 6.9.x branch. These versions include the fix for the memory leak in the TXT file texture attribute handling. Additionally, consider implementing input validation and file-type restrictions at the application level to reject or sanitize TXT files before passing them to ImageMagick. For systems unable to upgrade immediately, restrict ImageMagick processing to trusted sources only and monitor memory usage for signs of resource exhaustion.

Patch guidance

Verify the available patches through your ImageMagick distribution or the official ImageMagick repository. The fixes are integrated into version 7.1.2-15 and 6.9.13-40. If you maintain a custom ImageMagick build, apply the memory deallocation fix to coders/txt.c to ensure the texture object is properly freed when GetTypeMetrics fails. Test the patched version in a non-production environment before deploying, particularly if you run heavy TXT file processing workloads. Monitor system performance after patching to confirm memory leak behavior ceases.

Detection guidance

Monitor ImageMagick processes for abnormal memory growth over time, particularly in systems that process TXT files. Tracking resident set size (RSS) or heap usage trends can reveal slow memory leaks before availability is impacted. Enable process-level resource monitoring and alert on sustained memory consumption increases. Additionally, inspect access logs for attempts to upload or process TXT files with unusual texture attribute definitions. If using ImageMagick in a containerized environment, memory limit enforcement will cause process crashes, signaling potential exploitation; correlate these crashes with TXT file submissions. Analyze coredumps from crashed ImageMagick processes to confirm memory exhaustion.

Why prioritize this

This vulnerability merits prompt but not emergency attention. While it is remotely exploitable without authentication, the impact is limited to denial of service affecting availability, not confidentiality or integrity. The CVSS score of 5.3 (Medium) appropriately reflects the moderate risk profile. Prioritization should account for exposure: organizations accepting user-supplied TXT files or running ImageMagick on internet-facing services should patch within 30 days; those processing only internal or trusted files can take a standard patching window. The lack of KEV designation indicates no active in-the-wild exploitation has been observed, reducing immediate urgency.

Risk score, explained

The CVSS 3.1 score of 5.3 (Medium severity) is driven by the attack vector (Network), low attack complexity, no privileges required, no user interaction, and universal scope. The impact is limited to availability (A:L)—a low availability impact reflecting that exploitation causes resource exhaustion and denial of service, not data breach or system compromise. Confidentiality and integrity are not affected (C:N, I:N). The score would be higher if the vulnerability enabled code execution or data exfiltration; it would be lower if it required local access or user interaction. For organizations with high uptime requirements or limited redundancy, the business risk may exceed the base CVSS score.

Frequently asked questions