CVE-2026-109281
Received Received - Intake

Heap Buffer Over-read in ImageMagick via -fx Option

Publication date: 2026-10-12

Last updated on: 2026-10-12

Assigner: VulnCheck

Description
ImageMagick 7.1.0-21 before 7.1.2-32 contains a heap buffer over-read in its handling of the -fx option, where a certain -fx operation reads beyond the bounds of an allocated heap buffer in specific situations. Attackers who can get a crafted -fx expression processed can read out-of-bounds heap memory, potentially disclosing limited memory contents.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-12
Last Modified
2026-10-12
Generated
2026-10-12
AI Q&A
2026-10-12
EPSS Evaluated
N/A
NVD
CVE-2026-109281
EUVD
EUVD-2026-97583

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
ImageMagick ImageMagick 7.1.0-21

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-125 The product reads data past the end, or before the beginning, of the intended buffer.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a heap buffer over-read in ImageMagick 7.1.0-21 before 7.1.2-32 when processing the -fx option. Attackers can craft a specific -fx expression to read beyond allocated heap memory, potentially exposing limited memory contents.

Detection Guidance

To detect this vulnerability, check the installed version of ImageMagick using the command: convert --version or magick --version. If the version is between 7.1.0-21 and 7.1.2-31, the system is vulnerable. Additionally, monitor for any suspicious use of the -fx option in ImageMagick commands.

Impact Analysis

An attacker who can process a crafted -fx expression may read small amounts of sensitive memory. This could lead to information disclosure but does not allow code execution or system compromise. The impact is limited to data exposure.

Compliance Impact

This vulnerability involves a heap buffer over-read in ImageMagick's -fx option, allowing limited memory disclosure. It does not directly impact compliance with GDPR or HIPAA as it does not involve unauthorized data access, processing, or disclosure of sensitive personal or health information. The issue is local and requires user interaction, with low severity and no known impact on confidentiality or integrity of sensitive data.

Mitigation Strategies

Immediately update ImageMagick to version 7.1.2-32 or later. If updating is not possible, disable the -fx option in ImageMagick configurations or restrict its use to trusted inputs to prevent exploitation.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-109281. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart