Executive brief
ImageMagick is an image manipulation library used by many web applications and services to process image files. A memory leak vulnerability exists when processing TXT files that contain texture attributes—crafted files can cause the application to leak memory repeatedly, potentially degrading system performance over time if many such files are processed.
Technical details
A memory leak exists in coders/txt.c where the texture object allocated via ReadImage() is not properly released when GetTypeMetrics() fails. When processing a TXT file with a texture attribute, if GetTypeMetrics returns MagickFalse, the function exits without freeing the texture object. The vulnerability is triggered by supplying a crafted TXT file with a texture attribute to any ImageMagick component that processes TXT files. The attack vector is network-accessible (file upload, image conversion services) and requires no authentication or user interaction beyond providing a malicious file. An attacker can cause incremental memory exhaustion through repeated processing of crafted files, leading to potential denial of service.
Affected products
- ImageMagick ImageMagick before 7.1.2-15 and 6.9.13-40
- dlemstra Magick.NET-Q16-AnyCPU before 14.10.3
Timeline
- 2026-02-23: disclosed
- 2026-09-24: other: Advisory withdrawn as duplicate of GHSA-3q5f-gmjc-38r8