CVE-2026-109271: ImageMagick 7.1.2-30 before 7.1.2-32 Use After Free in WBINFO Decoder
ImageMagick 7.1.2-30 before 7.1.2-32 contains a use after free vulnerability in the WBINFO decoder that occurs when a memory allocation fails during image decoding. Attackers can supply a crafted image that, when decoded under memory allocation failure conditions, causes freed memory to be reused, crashing the application.
Affected Software
Event History
Frequently Asked Questions
Which deployments are affected?
ImageMagick versions 7.1.2-30 and 7.1.2-31 are affected. Exposure requires decoding WBINFO images; the provided data does not indicate whether WBINFO decoding is enabled by default.
What does an attacker need to trigger the issue?
An attacker needs to supply a crafted image that is processed by the WBINFO decoder while a memory allocation failure occurs. No authentication or user interaction is required according to the supplied vector.
What is the expected impact of successful exploitation?
The documented outcome is application crash due to reuse of freed memory, resulting in availability impact. The supplied severity vector indicates no confidentiality or integrity impact.
What should teams do if they cannot patch immediately?
Avoid decoding untrusted WBINFO images, particularly in workflows that may operate under memory pressure. Upgrade affected installations to 7.1.2-32 or later when possible.