ImageMagick: Memory leak in coders/txt.c without freetype (CVE-2026-56371)

Why this deserves its current priority

CVSS is 5.3. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.

Analysis status

Analysis pending evidence review

Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.

Affected scope and exposure questions

The current feed maps Magick.NET-Q16-AnyCPU (nuget), Magick.NET-Q16-arm64 (nuget), Magick.NET-Q16-HDRI-AnyCPU (nuget), Magick.NET-Q16-HDRI-arm64 (nuget) and additional mapped packages. Check affected ranges and fixed versions before updating.

Mapped affected packages and fixed versions
Package	Affected range	Fixed version
Magick.NET-Q16-AnyCPUnuget	<14.10.3	14.10.3
Magick.NET-Q16-arm64nuget	<14.10.3	14.10.3
Magick.NET-Q16-HDRI-AnyCPUnuget	<14.10.3	14.10.3
Magick.NET-Q16-HDRI-arm64nuget	<14.10.3	14.10.3
Magick.NET-Q16-HDRI-OpenMP-arm64nuget	<14.10.3	14.10.3
Magick.NET-Q16-HDRI-OpenMP-x64nuget	<14.10.3	14.10.3
Magick.NET-Q16-HDRI-x64nuget	<14.10.3	14.10.3
Magick.NET-Q16-HDRI-x86nuget	<14.10.3	14.10.3
Magick.NET-Q16-OpenMP-arm64nuget	<14.10.3	14.10.3
Magick.NET-Q16-OpenMP-x64nuget	<14.10.3	14.10.3
Magick.NET-Q16-OpenMP-x86nuget	<14.10.3	14.10.3
Magick.NET-Q16-x64nuget	<14.10.3	14.10.3
Magick.NET-Q16-x86nuget	<14.10.3	14.10.3
Magick.NET-Q8-AnyCPUnuget	<14.10.3	14.10.3
Magick.NET-Q8-arm64nuget	<14.10.3	14.10.3
Magick.NET-Q8-OpenMP-arm64nuget	<14.10.3	14.10.3
Magick.NET-Q8-OpenMP-x64nuget	<14.10.3	14.10.3
Magick.NET-Q8-x64nuget	<14.10.3	14.10.3
Magick.NET-Q8-x86nuget	<14.10.3	14.10.3

Recommended response

Check inventory. Check lockfiles and deployed manifests for Magick.NET-Q16-AnyCPU, Magick.NET-Q16-arm64, Magick.NET-Q16-HDRI-AnyCPU.
Review the reported fix. Update Magick.NET-Q16-AnyCPU to 14.10.3; Magick.NET-Q16-arm64 to 14.10.3; Magick.NET-Q16-HDRI-AnyCPU to 14.10.3; Magick.NET-Q16-HDRI-arm64 to 14.10.3; Magick.NET-Q16-HDRI-OpenMP-arm64 to 14.10.3; Magick.NET-Q16-HDRI-OpenMP-x64 to 14.10.3; Magick.NET-Q16-HDRI-x64 to 14.10.3; Magick.NET-Q16-HDRI-x86 to 14.10.3; Magick.NET-Q16-OpenMP-arm64 to 14.10.3; Magick.NET-Q16-OpenMP-x64 to 14.10.3; Magick.NET-Q16-OpenMP-x86 to 14.10.3; Magick.NET-Q16-x64 to 14.10.3; Magick.NET-Q16-x86 to 14.10.3; Magick.NET-Q8-AnyCPU to 14.10.3; Magick.NET-Q8-arm64 to 14.10.3; Magick.NET-Q8-OpenMP-arm64 to 14.10.3; Magick.NET-Q8-OpenMP-x64 to 14.10.3; Magick.NET-Q8-x64 to 14.10.3; Magick.NET-Q8-x86 to 14.10.3 if you use the affected versions. Test the change in a non-production environment first.

Evidence timeline and material changes

Published upstream
Feb 25, 2026
Evidence: source:ghsa:source_dates:source-dates:record
Source modified
Sep 24, 2026
Evidence: source:ghsa:source_dates:source-dates:record
First seen by HOL
Jun 23, 2026

Sources and claim methodology

Upstream source description

If a `texture` attribute is specified for a TXT file, an attempt will be made to read it via `texture=ReadImage(read_info,exception);`. Later, when retrieving metrics via the `GetTypeMetrics` function, if this function fails (i.e., `status == MagickFalse`), the calling function will exit immediately but fail to release the texture object, leading to memory leakage.

Quoted source text, attributed separately from HOL analysis.