CVE-2026-109280
Received Received - Intake

Use After Free in ImageMagick via -fx Option

Publication date: 2026-10-12

Last updated on: 2026-10-12

Assigner: VulnCheck

Description
ImageMagick 7.1.0-20 before 7.1.2-32 contains a use after free vulnerability in the -fx option that occurs when a memory allocation fails during a specific operation. Attackers who can supply crafted -fx expressions under memory pressure can trigger freed memory access, causing crashes or memory corruption.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-12
Last Modified
2026-10-12
Generated
2026-10-12
AI Q&A
2026-10-12
EPSS Evaluated
N/A
NVD
CVE-2026-109280
EUVD
EUVD-2026-97582

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
ImageMagick ImageMagick 7.1.0-20

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-476 The product dereferences a pointer that it expects to be valid but is NULL.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-109280 is a use-after-free vulnerability in ImageMagick 7.1.0-20 through 7.1.2-31. It occurs when memory allocation fails during a specific -fx operation. Attackers can exploit this by providing crafted -fx expressions under memory pressure, causing freed memory to be accessed. This leads to crashes or memory corruption.

Detection Guidance

To detect this vulnerability, check the installed ImageMagick version using the command: convert --version or magick --version. If the version is below 7.1.2-32, the system is vulnerable. Additionally, monitor for crashes or memory corruption when using the -fx option under memory pressure.

Impact Analysis

This vulnerability primarily impacts system availability. It can cause crashes or memory corruption when processing certain -fx expressions. The attack requires local access and memory pressure conditions, making it harder to exploit but still a risk for affected systems.

Mitigation Strategies

Immediately update ImageMagick to version 7.1.2-32 or later. If updating is not possible, avoid using the -fx option, especially in environments with limited memory. Implement memory monitoring to detect allocation failures.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-109280. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart