ImageMagick Invalid Memory Free in FX Operation
Key facts
- Attack vector
- Local
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- Present
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · None · Low
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-476.
Summary
ImageMagick from 7.1.0-20 before 7.1.2-32 contains an invalid memory free in the fx operation. The flaw occurs when initialization of an FX runtime entry fails, and the resulting invalid free corrupts memory and crashes the application (CWE-476). A local attacker with low privileges can trigger the failed initialization.
Written with Claude Haiku 5.5 from the sources below · 2026-10-29
Description from the CNA
ImageMagick 7.1.0-20 before 7.1.2-32 contains an invalid memory free vulnerability in the fx operation that occurs when initialization of an FX runtime entry fails. Attackers can trigger the failed FX runtime initialization to cause an invalid free, resulting in memory corruption and application crashes.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| ImageMagick | ImageMagick | 7.1.0-20 to before 7.1.2-32 | 7.1.2-32 | Patch available | CNA |
- ImageMagick VendorImageMagick Affected 7.1.0-20 to before 7.1.2-32 Fixed in 7.1.2-32 Patch available CNA
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:imagemagick:imagemagick:*:*:*:*:*:*:*:* | 7.1.0-20 to before 7.1.2-32 | Vulnerable | ImageMagick |
- cpe:2.3:a:imagemagick:imagemagick:*:*:*:*:*:*:*:* Versions 7.1.0-20 to before 7.1.2-32 Vulnerable ·ImageMagick
Remediation
Upgrade ImageMagick to fixed version 7.1.2-32.
Written with Claude Haiku 5.5 from the sources below · 2026-10-29
- Fix · CNA ImageMagick (ImageMagick) Fixed in 7.1.2-32
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Release ·
ImageMagick 7.1.2-32
25 records Highest priority Priority LOW 25 LOW
Other records, highest priority first
- TI-2026-71092 Temporary file leak in ImageMagick JNG decoderPriority LOW 37
- TI-2026-71081 Heap buffer over-read in ImageMagick via crafted XMP profilePriority LOW 37
- TI-2026-71078 Memory leak in ImageMagick SVG encoder enables denial of servicePriority LOW 37
Vendor assessments
Red Hat
Red Hat rating: Low. Red Hat's page for this CVE →
Not affected: 2 products
- Red Hat Enterprise Linux 6
- Red Hat Enterprise Linux 7
Timeline
- 2026-10-12 Threatist record created from CVE-2026-109258
- 2026-10-12 Alias added: GHSA-qr3h-jrh3-5m34
- 2026-10-13 Affected versions changed · Red Hat
- 2026-10-13 CVSS score added · Red Hat
- 2026-10-13 CISA SSVC decision points changed
- 2026-11-03 CVSS score added · NVD
References
Patch 1
More Imagemagick vulnerabilities
- TI-2016-03144 The (1) EPHEMERAL, (2) HTTPS, (3) MVG, (4) MSL, (5) TEXT, (6) SHOW, (7) WIN, and (8) PLT… KEVCVSS 3.1HIGH 8.4
- TI-2023-16996 Improper input validation in ImageMagick CVSS 3.1CRITICAL 9.8
- TI-2016-03148 The (1) HTTP and (2) FTP coders in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1… KEVCVSS 3.1MEDIUM 5.5
- TI-2016-03145 The EPHEMERAL coder in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allows remote… KEVCVSS 3.1MEDIUM 5.5
- TI-2025-35690 ImageMagick BlobStream Forward-Seek Under-Allocation CVSS 3.1CRITICAL 9.8
- TI-2025-33094 ImageMagick has Stack Buffer Overflow in image.c CVSS 3.1CRITICAL 9.8
Sources
- CVE-2026-109258 · CVE Program
- CVE-2026-109258 · NVD
- FIRST EPSS
- GHSA-qr3h-jrh3-5m34 · GitHub Advisory Database · CC BY 4.0
- CVE-2026-109258 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences