CVE WatchJul 2, 2026

CVE-2026-56371

ImageMagick before 7.1.2-15 and 6.9.13-40 contains a memory leak in coders/txt.c when processing TXT files with texture attributes: the text

CVSS

5.3

Medium

EPSS

0.3%

p17

KEV

—

Exploit Today

0-100

Published: Jun 23, 2026 · Last modified: Jul 2, 2026 · CWE-401

EPSS · 30d

0.2%EPSS · 30 days0.3%

2026-06-302026-07-20

Technical description

ImageMagick before 7.1.2-15 and 6.9.13-40 contains a memory leak in coders/txt.c when processing TXT files with texture attributes: the texture object allocated via ReadImage is not released when GetTypeMetrics fails, leaking memory each time a crafted TXT file with a texture attribute is processed.

Official references

Related CVEs

CVECVSSEPSSKEVRExploitTitleMod.

CVE-2026-618722.5 LOW

0.9%

——0ImageMagick before 7.1.2-26 and 6.9.13-51 contains a memory leak in the TIFF encoder when an invalid tiff:tile-geometry is specified. Supplying malformed tile geometry parameters causes allocated memory not to be released, which can lead to increased memory consumption.6d CVE-2026-618713.7 LOW

14.1%

——4ImageMagick before 7.1.2-26 and 6.9.13-51 contains a memory leak in the ICON decoder that occurs when a memory allocation fails. Processing a crafted ICON file that triggers an allocation failure leaks memory, which may lead to a denial of service.6d CVE-2026-618692.9 LOW

1.1%

——0ImageMagick before 7.1.2-26 and 6.9.13-51 contains a memory leak in the MIFF encoder that occurs when a memory allocation fails during MIFF image processing, which can lead to denial of service.6d CVE-2026-618683.7 LOW

12.8%

——4ImageMagick before 7.1.2-26 and 6.9.x before 6.9.13-51 contains a memory leak in the YUV decoder that occurs when opening of the blob fails. Repeated triggering can lead to resource exhaustion (denial of service).6d CVE-2026-618672.9 LOW

1.1%

——0ImageMagick before 7.1.2-26 contains a memory leak vulnerability in the TIFF encoder when memory allocation fails. Attackers can trigger allocation failures during TIFF image processing to cause memory exhaustion and denial of service.6d CVE-2026-618662.9 LOW

8.6%

——3ImageMagick before 7.1.2-26 contains a memory leak vulnerability in the JNG encoder when a blob cannot be opened. Attackers can trigger the memory leak by providing malformed JNG files that fail blob operations, causing resource exhaustion.5d