CVE-2026-56371: ImageMagick Memory Leak DOS Vulnerability

CVE-2026-56371 Overview

CVE-2026-56371 is a memory leak vulnerability in ImageMagick affecting versions before 7.1.2-15 and 6.9.13-40. The flaw resides in coders/txt.c when processing TXT files containing texture attributes. The texture object allocated through ReadImage is not released when GetTypeMetrics fails, leaking memory on every crafted file processed.

Repeated processing of malicious TXT inputs causes progressive memory consumption in services that rely on ImageMagick for image conversion. The vulnerability is tracked as [CWE-401] (Missing Release of Memory after Effective Lifetime).

Critical Impact
Attackers can trigger sustained memory exhaustion in ImageMagick-backed services by submitting crafted TXT files with texture attributes, degrading availability over time.

Affected Products

ImageMagick versions prior to 7.1.2-15
ImageMagick 6.x versions prior to 6.9.13-40
Applications and services embedding vulnerable ImageMagick builds for TXT file handling

Discovery Timeline

2026-06-23 - CVE-2026-56371 published to NVD
2026-06-24 - Last updated in NVD database

Technical Details for CVE-2026-56371

Vulnerability Analysis

The defect sits in the TXT coder implementation at coders/txt.c. When ImageMagick parses a TXT file that declares a texture attribute, it allocates a texture image object through a call to ReadImage. The code path then invokes GetTypeMetrics to obtain font metrics for subsequent rendering operations.

When GetTypeMetrics fails, the function returns without freeing the previously allocated texture object. The allocation handle goes out of scope and the memory is never reclaimed. Each parse of a malicious TXT input repeats this leak, allowing an attacker to amplify resource consumption by submitting the file in a loop.

Applications expose this code path whenever they accept user-supplied images and pass them through ImageMagick utilities such as convert, identify, or library bindings like Wand or MagickCore. Long-running services that process untrusted input are most at risk, since accumulated leaks eventually exhaust process memory and trigger out-of-memory termination.

Root Cause

The root cause is an unbalanced allocation in the error path of the TXT reader. The texture object lifetime is tied to the success of GetTypeMetrics, but no cleanup branch releases the object when that call fails. This is a classic [CWE-401] memory leak pattern.

Attack Vector

A remote attacker uploads or submits a crafted TXT file with a texture attribute to any service that delegates image parsing to ImageMagick. No authentication or user interaction is required when the endpoint is publicly reachable. Repeated submissions amplify the leak into a denial-of-service condition.

No verified public proof-of-concept code is available. Refer to the GitHub Security Advisory and the VulnCheck Advisory for technical details.

Detection Methods for CVE-2026-56371

Indicators of Compromise

Sustained growth in resident set size (RSS) of processes running convert, magick, or services linking libMagickCore
Repeated inbound uploads of TXT files containing texture= attribute declarations
Out-of-memory (OOM) kills affecting image-processing workers without corresponding traffic spikes in other endpoints

Detection Strategies

Inspect image-upload pipelines for TXT MIME types and inline texture attribute strings before invoking ImageMagick
Correlate ImageMagick process memory growth with the volume of TXT files processed over a rolling window
Audit application logs for repeated GetTypeMetrics failures emitted by ImageMagick at the warning level

Monitoring Recommendations

Track per-worker memory metrics for any service using ImageMagick and alert on monotonic growth
Monitor OOM killer events and process restart frequency on image-conversion hosts
Forward ImageMagick policy and error logs to a central log platform for retrospective analysis

How to Mitigate CVE-2026-56371

Immediate Actions Required

Upgrade ImageMagick to 7.1.2-15 or later, or to 6.9.13-40 or later on the 6.x branch
Inventory all hosts, containers, and language bindings that ship vulnerable ImageMagick libraries
Restrict accepted image formats at the application layer to exclude TXT where it is not required

Patch Information

ImageMagick maintainers released fixed versions 7.1.2-15 and 6.9.13-40 that free the texture object on the GetTypeMetrics failure path. Patch details and references are published in the GitHub Security Advisory GHSA-3q5f-gmjc-38r8.

Workarounds

Disable the TXT coder in policy.xml until patches can be deployed across all systems
Enforce per-request memory and time limits on ImageMagick worker processes using cgroups or ulimit
Place image-processing workers behind a supervisor that recycles them after a fixed number of requests

bash

# Configuration example: disable the TXT coder in ImageMagick policy.xml
# Typical path: /etc/ImageMagick-7/policy.xml or /etc/ImageMagick-6/policy.xml
<policymap>
  <policy domain="coder" rights="none" pattern="TXT" />
  <policy domain="resource" name="memory" value="256MiB" />
  <policy domain="resource" name="map" value="512MiB" />
</policymap>