CVE-2026-109280: ImageMagick 7.1.0-20 before 7.1.2-32 Use After Free via -fx Option
ImageMagick 7.1.0-20 before 7.1.2-32 contains a use after free vulnerability in the -fx option that occurs when a memory allocation fails during a specific operation. Attackers who can supply crafted -fx expressions under memory pressure can trigger freed memory access, causing crashes or memory corruption.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
ImageMagick versions from 7.1.0-20 through versions before 7.1.2-32 are affected. Exposure requires use of the -fx option.
What does an attacker need to exploit it?
An attacker needs the ability to supply a crafted -fx expression and must be able to trigger the operation while memory allocation fails under memory pressure. The CVSS vector also indicates local access and low privileges are required.
What is the likely impact of successful exploitation?
Successful triggering can access freed memory, resulting in crashes or memory corruption. The provided severity data rates availability impact as low and does not indicate confidentiality or integrity impact.