ImageMagick has possible memory leak in ASHLAR coder when action fails

LOW 3.3CVE-2026-56375 · GHSA-6p22-q7w5-33pg · Published 15/07/2026 · updated 25/10/2026

Package	Affected versions	Patched versions
Magick.NET-Q16-AnyCPU NuGet	`< 14.11.1`	`14.11.1`
Magick.NET-Q16-HDRI-AnyCPU NuGet	`< 14.11.1`	`14.11.1`
Magick.NET-Q16-HDRI-OpenMP-arm64 NuGet	`< 14.11.1`	`14.11.1`
Magick.NET-Q16-HDRI-arm64 NuGet	`< 14.11.1`	`14.11.1`
Magick.NET-Q16-HDRI-x64 NuGet	`< 14.11.1`	`14.11.1`
Magick.NET-Q16-HDRI-x86 NuGet	`< 14.11.1`	`14.11.1`
Magick.NET-Q16-OpenMP-arm64 NuGet	`< 14.11.1`	`14.11.1`
Magick.NET-Q16-OpenMP-x64 NuGet	`< 14.11.1`	`14.11.1`
Magick.NET-Q16-OpenMP-x86 NuGet	`< 14.11.1`	`14.11.1`
Magick.NET-Q16-arm64 NuGet	`< 14.11.1`	`14.11.1`
Magick.NET-Q16-x64 NuGet	`< 14.11.1`	`14.11.1`
Magick.NET-Q16-x86 NuGet	`< 14.11.1`	`14.11.1`
Magick.NET-Q8-AnyCPU NuGet	`< 14.11.1`	`14.11.1`
Magick.NET-Q8-OpenMP-arm64 NuGet	`< 14.11.1`	`14.11.1`
Magick.NET-Q8-OpenMP-x64 NuGet	`< 14.11.1`	`14.11.1`
Magick.NET-Q8-arm64 NuGet	`< 14.11.1`	`14.11.1`
Magick.NET-Q8-x64 NuGet	`< 14.11.1`	`14.11.1`
Magick.NET-Q8-x86 NuGet	`< 14.11.1`	`14.11.1`

Description

The ASHLAR coder leaks a temporary image when an action fails and that could result to an out of memory.

NVD description

ImageMagick through 7.1.2-18 contains a memory leak vulnerability in the ASHLAR coder when an action fails. Attackers can trigger failed actions to exhaust memory resources and cause denial of service.

References

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free