CVE-2026-56375: ImageMagick ASHLAR Coder DoS Vulnerability

CVE-2026-56375 Overview

CVE-2026-56375 is a memory leak vulnerability in ImageMagick through version 7.1.2-18. The flaw resides in the ASHLAR coder and is triggered when an action fails during image processing. Attackers who can supply crafted input to ImageMagick can force repeated action failures, causing the process to leak memory on each invocation. Sustained exploitation exhausts available memory and results in denial of service against applications and services that rely on ImageMagick for image conversion or manipulation. The weakness maps to CWE-401: Missing Release of Memory after Effective Lifetime.

Critical Impact
A local attacker who can induce ASHLAR coder action failures can exhaust process memory and disrupt any workload that depends on ImageMagick.

Affected Products

ImageMagick versions up to and including 7.1.2-18
Applications and services embedding vulnerable ImageMagick libraries for image processing
Server-side image conversion pipelines invoking the ASHLAR coder

Discovery Timeline

2026-07-15 - CVE-2026-56375 published to the National Vulnerability Database (NVD)
2026-07-15 - Last updated in NVD database

Technical Details for CVE-2026-56375

Vulnerability Analysis

The vulnerability is a memory leak in the ASHLAR coder within ImageMagick. When an action performed by the coder fails, the code path exits without releasing memory previously allocated for the operation. Each failed action leaves an unreferenced allocation behind. Repeated failures compound the leak until the host process runs out of usable memory. The impact is limited to availability. There is no direct effect on confidentiality or integrity, and exploitation requires local access with user interaction to submit input to the coder.

Root Cause

The root cause is missing cleanup on error paths within the ASHLAR coder implementation. Under [CWE-401], resources acquired during an operation must be released along every exit path, including error and failure branches. In this coder, one or more failure branches skip the deallocation routines. Because ImageMagick processes untrusted image data by design, any caller-controlled input that reliably triggers an ASHLAR action failure becomes a repeatable leak primitive.

Attack Vector

An attacker supplies image data that causes ASHLAR coder actions to fail. This can occur through command-line tools such as convert or magick, through library bindings, or through server-side services that pass user-uploaded files to ImageMagick. Each request that triggers the failure leaks memory in the handling process. Automated submission of many crafted inputs drives the process toward memory exhaustion and denial of service. Exploitation requires local access and user interaction with the vulnerable interface. See the GitHub Security Advisory GHSA-6p22-q7w5-33pg and the VulnCheck Advisory on ImageMagick Memory Leak for additional technical detail.

// No verified proof-of-concept code is published for CVE-2026-56375.
// Refer to the GitHub Security Advisory (GHSA-6p22-q7w5-33pg) for technical details.

Detection Methods for CVE-2026-56375

Indicators of Compromise

Steady, unexplained growth in resident memory of processes invoking ImageMagick binaries such as magick, convert, or identify
Elevated volumes of failed ASHLAR coder operations recorded in application logs
Out-of-memory (OOM) kills of image-processing workers or containers running ImageMagick

Detection Strategies

Inventory hosts and container images to identify ImageMagick installations at or below version 7.1.2-18
Instrument image-processing services to log coder name, input source, and failure status for each conversion
Baseline normal memory consumption of ImageMagick worker processes and alert on sustained upward drift

Monitoring Recommendations

Track memory usage per ImageMagick process and per container using standard host and orchestration metrics
Monitor OOM killer events in kernel logs and correlate them with ImageMagick process identifiers
Alert on repeated ASHLAR coder failures from the same source, user, or upload endpoint

How to Mitigate CVE-2026-56375

Immediate Actions Required

Identify all systems and container images running ImageMagick versions up to 7.1.2-18 and prioritize them for patching
Restrict which coders ImageMagick will process by policy, disabling ASHLAR where it is not required
Apply resource limits to image-processing workers so a leaking process is bounded and recycled before affecting the host

Patch Information

Refer to the GitHub Security Advisory GHSA-6p22-q7w5-33pg for the fixed version and upgrade guidance from the ImageMagick maintainers. Update ImageMagick to the patched release across operating system packages, language bindings, and container base images. Rebuild and redeploy any application images that bundle the vulnerable library.

Workarounds

Disable the ASHLAR coder in policy.xml until the patched version is deployed
Enforce memory limits (MAP, MEMORY, AREA) in the ImageMagick resource policy to cap per-process allocations
Run image conversion in short-lived, isolated worker processes or containers that are recycled after a fixed number of requests

bash

# Configuration example: disable the ASHLAR coder in ImageMagick policy.xml
# Typical path: /etc/ImageMagick-7/policy.xml
<policymap>
  <policy domain="coder" rights="none" pattern="ASHLAR" />
  <policy domain="resource" name="memory" value="256MiB" />
  <policy domain="resource" name="map" value="512MiB" />
</policymap>