CVE-2026-109258
Received Received - Intake

Memory Corruption in ImageMagick via Invalid Free in FX Operation

Publication date: 2026-10-12

Last updated on: 2026-10-12

Assigner: VulnCheck

Description
ImageMagick 7.1.0-20 before 7.1.2-32 contains an invalid memory free vulnerability in the fx operation that occurs when initialization of an FX runtime entry fails. Attackers can trigger the failed FX runtime initialization to cause an invalid free, resulting in memory corruption and application crashes.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-12
Last Modified
2026-10-12
Generated
2026-10-12
AI Q&A
2026-10-12
EPSS Evaluated
N/A
NVD
CVE-2026-109258
EUVD
EUVD-2026-97702

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
ImageMagick ImageMagick 7.1.0-20

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-476 The product dereferences a pointer that it expects to be valid but is NULL.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in ImageMagick 7.1.0-20 before 7.1.2-32 involves an invalid memory free issue during the fx operation. When FX runtime entry initialization fails, attackers can trigger this to cause an invalid free, leading to memory corruption and application crashes.

Detection Guidance

This vulnerability can be detected by checking the ImageMagick version installed on your system. If you are running ImageMagick 7.1.0-20 through 7.1.2-31, you are likely vulnerable. Run the command 'magick -version' or 'convert -version' to check the version.

Impact Analysis

This vulnerability may cause memory corruption and application crashes on systems using vulnerable versions of ImageMagick. It requires local access and has low impact on confidentiality, integrity, and availability, but could disrupt operations.

Compliance Impact

This vulnerability does not directly impact compliance with GDPR or HIPAA. It is a low-severity memory corruption issue in ImageMagick's FX operation that could cause application crashes but does not involve data breaches or unauthorized access to sensitive information.

Mitigation Strategies

Immediately update ImageMagick to version 7.1.2-32 or later. If updating is not possible, disable the fx operation or restrict access to ImageMagick in your environment.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-109258. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart