—0.0
GHSA-3q5f-gmjc-38r8
ImageMagick: Memory leak in coders/txt.c without freetype
Quick fix
GHSA-3q5f-gmjc-38r8 — Magick.NET-Q16-AnyCPU: upgrade to the fixed version with the command below.
dotnet add package Magick.NET-Q16-AnyCPU --version 14.10.3Details
If a `texture` attribute is specified for a TXT file, an attempt will be made to read it via `texture=ReadImage(read_info,exception);`. Later, when retrieving metrics via the `GetTypeMetrics` function, if this function fails (i.e., `status == MagickFalse`), the calling function will exit immediately but fail to release the texture object, leading to memory leakage.
Are you affected?
Enter the version of the package you're using.
Affected packages
NuGet/Magick.NET-Q16-AnyCPU
Introduced in:
0Fixed in: 14.10.3Fix
dotnet add package Magick.NET-Q16-AnyCPU --version 14.10.3NuGet/Magick.NET-Q16-HDRI-AnyCPU
Introduced in:
0Fixed in: 14.10.3Fix
dotnet add package Magick.NET-Q16-HDRI-AnyCPU --version 14.10.3NuGet/Magick.NET-Q16-HDRI-OpenMP-arm64
Introduced in:
0Fixed in: 14.10.3Fix
dotnet add package Magick.NET-Q16-HDRI-OpenMP-arm64 --version 14.10.3NuGet/Magick.NET-Q16-HDRI-OpenMP-x64
Introduced in:
0Fixed in: 14.10.3Fix
dotnet add package Magick.NET-Q16-HDRI-OpenMP-x64 --version 14.10.3NuGet/Magick.NET-Q16-HDRI-arm64
Introduced in:
0Fixed in: 14.10.3Fix
dotnet add package Magick.NET-Q16-HDRI-arm64 --version 14.10.3NuGet/Magick.NET-Q16-HDRI-x64
Introduced in:
0Fixed in: 14.10.3Fix
dotnet add package Magick.NET-Q16-HDRI-x64 --version 14.10.3NuGet/Magick.NET-Q16-HDRI-x86
Introduced in:
0Fixed in: 14.10.3Fix
dotnet add package Magick.NET-Q16-HDRI-x86 --version 14.10.3NuGet/Magick.NET-Q16-OpenMP-arm64
Introduced in:
0Fixed in: 14.10.3Fix
dotnet add package Magick.NET-Q16-OpenMP-arm64 --version 14.10.3NuGet/Magick.NET-Q16-OpenMP-x64
Introduced in:
0Fixed in: 14.10.3Fix
dotnet add package Magick.NET-Q16-OpenMP-x64 --version 14.10.3NuGet/Magick.NET-Q16-OpenMP-x86
Introduced in:
0Fixed in: 14.10.3Fix
dotnet add package Magick.NET-Q16-OpenMP-x86 --version 14.10.3NuGet/Magick.NET-Q16-arm64
Introduced in:
0Fixed in: 14.10.3Fix
dotnet add package Magick.NET-Q16-arm64 --version 14.10.3NuGet/Magick.NET-Q16-x64
Introduced in:
0Fixed in: 14.10.3Fix
dotnet add package Magick.NET-Q16-x64 --version 14.10.3NuGet/Magick.NET-Q16-x86
Introduced in:
0Fixed in: 14.10.3Fix
dotnet add package Magick.NET-Q16-x86 --version 14.10.3NuGet/Magick.NET-Q8-AnyCPU
Introduced in:
0Fixed in: 14.10.3Fix
dotnet add package Magick.NET-Q8-AnyCPU --version 14.10.3NuGet/Magick.NET-Q8-OpenMP-arm64
Introduced in:
0Fixed in: 14.10.3Fix
dotnet add package Magick.NET-Q8-OpenMP-arm64 --version 14.10.3NuGet/Magick.NET-Q8-OpenMP-x64
Introduced in:
0Fixed in: 14.10.3Fix
dotnet add package Magick.NET-Q8-OpenMP-x64 --version 14.10.3NuGet/Magick.NET-Q8-arm64
Introduced in:
0Fixed in: 14.10.3Fix
dotnet add package Magick.NET-Q8-arm64 --version 14.10.3NuGet/Magick.NET-Q8-x64
Introduced in:
0Fixed in: 14.10.3Fix
dotnet add package Magick.NET-Q8-x64 --version 14.10.3NuGet/Magick.NET-Q8-x86
Introduced in:
0Fixed in: 14.10.3Fix
dotnet add package Magick.NET-Q8-x86 --version 14.10.3References
- https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-3q5f-gmjc-38r8[WEB]
- https://nvd.nist.gov/vuln/detail/CVE-2026-56371[ADVISORY]
- https://github.com/ImageMagick/ImageMagick/commit/e6394098af39a9689bb5f0b4eb6a9968e449a8d3[WEB]
- https://github.com/ImageMagick/ImageMagick[PACKAGE]
- https://github.com/dlemstra/Magick.NET/releases/tag/14.10.3[WEB]
- https://www.vulncheck.com/advisories/imagemagick-memory-leak-in-txt-file-processing-via-texture-attribute[WEB]