CVE-2026-109258: ImageMagick 7.1.0-20 before 7.1.2-32 Invalid Memory Free in FX Operation
ImageMagick 7.1.0-20 before 7.1.2-32 contains an invalid memory free vulnerability in the fx operation that occurs when initialization of an FX runtime entry fails. Attackers can trigger the failed FX runtime initialization to cause an invalid free, resulting in memory corruption and application crashes.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/imagemagickto a version that resolves this vulnerability.Fixed in 8:7.1.1.43+dfsg1-1+deb13u14 - Upgrade
Upgrade
debian/imagemagickto a version that resolves this vulnerability.Fixed in 8:7.1.2.33+dfsg1-1 - Upgrade
Upgrade
debian/imagemagickto a version that resolves this vulnerability.Fixed in 8:6.9.11.60+dfsg-1.6+deb12u11Fixed in 8:6.9.11.60+dfsg-1.6+deb12u15Fixed in 8:7.1.1.43+dfsg1-1+deb13u14Fixed in 8:7.1.2.34+dfsg1-1Fixed in 8:7.1.2.35+dfsg1-2
Event History
Frequently Asked Questions
Which ImageMagick versions are affected?
ImageMagick versions from 7.1.0-20 through versions before 7.1.2-32 are affected. Version 7.1.2-32 is not included in the affected range.
What access does an attacker need to exploit this issue?
The supplied severity vector indicates local access and low privileges are required. User interaction is not required, but exploitation has high attack complexity.
What is the likely impact?
An attacker able to trigger failed FX runtime initialization can cause an invalid memory free, leading to memory corruption and application crashes. The supplied vector indicates availability impact only, with no stated confidentiality or integrity impact.