CVE-2026-56371: ImageMagick - Memory Leak in TXT File Processing via Texture Attribute
ImageMagick before 7.1.2-15 and 6.9.13-40 contains a memory leak in coders/txt.c when processing TXT files with texture attributes: the texture object allocated via ReadImage is not released when GetTypeMetrics fails, leaking memory each time a crafted TXT file with a texture attribute is processed.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 7.1.2-15 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.9.13-40 - Compensating control
Until upgraded, avoid processing or opening untrusted/crafted TXT files that include texture attributes (to prevent triggering the memory leak in coders/txt.c).
Event History
Frequently Asked Questions
What is the severity of CVE-2026-56371?
The severity of CVE-2026-56371 is classified as low.
What is CVE-2026-56371 about?
CVE-2026-56371 describes a memory leak vulnerability in ImageMagick when processing TXT files with texture attributes.
How does CVE-2026-56371 affect ImageMagick?
CVE-2026-56371 causes a memory leak each time an improperly crafted TXT file is processed.
How do I fix CVE-2026-56371?
To fix CVE-2026-56371, upgrade to ImageMagick version 7.1.2-15 or 6.9.13-40 or later.
What are the consequences of CVE-2026-56371?
The primary consequence of CVE-2026-56371 is the potential for increased memory usage, leading to degraded performance.