CVE-2026-56375

What it actually does

A memory leak occurs in the ASHLAR image coder when an action fails, allowing repeated failed operations to consume available memory until the process terminates or the system becomes unresponsive.

Why it matters to the business

Attackers can cause image processing applications using ImageMagick to crash or become unavailable, disrupting workflows that rely on image handling without requiring elevated privileges.

How an attack unfolds

An attacker crafts or supplies an image or input that causes the ASHLAR coder to fail during processing. By repeatedly triggering such failures, memory is leaked until resources are exhausted, resulting in denial of service.

How to fix it

Upgrade ImageMagick to a version newer than 7.1.2-18 where the memory leak in the ASHLAR coder has been addressed. Monitor for official patches and apply them promptly.

How to confirm the fix worked

Test by attempting to process inputs that previously triggered failures in the ASHLAR coder and verify that memory usage remains stable without leaks. Use memory profiling tools to confirm no excessive allocation on failure paths.

Typical attack path

1. Identify an application using vulnerable ImageMagick with ASHLAR coder support
2. Supply malicious input designed to fail ASHLAR processing
3. Repeat the action to leak memory progressively
4. Observe system resource exhaustion leading to DoS

How to detect it

Look for repeated failures or error logs related to ASHLAR coder in ImageMagick processing. Monitor for unusual memory consumption spikes in processes using ImageMagick without corresponding successful outputs.

What your security team should do

• Prioritize updating ImageMagick installations to patched versions
• Restrict untrusted image inputs to applications using ImageMagick
• Implement resource limits on processes handling images to mitigate DoS effects
• Monitor EPSS and exploit availability for changes in risk