CVE-2026-109281: ImageMagick 7.1.0-21 before 7.1.2-32 Heap Buffer Over-Read via -fx Option
ImageMagick 7.1.0-21 before 7.1.2-32 contains a heap buffer over-read in its handling of the -fx option, where a certain -fx operation reads beyond the bounds of an allocated heap buffer in specific situations. Attackers who can get a crafted -fx expression processed can read out-of-bounds heap memory, potentially disclosing limited memory contents.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
ImageMagick versions from 7.1.0-21 before 7.1.2-32 are affected when they process a crafted -fx expression. The provided information does not identify any exposure outside that version range.
What access does an attacker need to exploit it?
An attacker must be able to cause ImageMagick to process a crafted -fx expression. The severity vector indicates local attack vector and low privileges required, with no user interaction required.
What is the likely impact of successful exploitation?
The flaw can cause an out-of-bounds read of heap memory and may disclose limited memory contents. The severity vector also indicates low confidentiality and availability impact, with no integrity impact.
What should be done to remediate the issue?
Upgrade ImageMagick to version 7.1.2-32 or later. If upgrading cannot happen immediately, prevent untrusted users or inputs from supplying -fx expressions for processing.