CVE-2026-109280: imagemagick imagemagick

CVSS 2.5 (low) · published 2026-10-12

ImageMagick 7.1.0-20 before 7.1.2-32 contains a use after free vulnerability in the -fx option that occurs when a memory allocation fails during a specific operation. Attackers who can supply crafted -fx expressions under memory pressure can trigger freed memory access, causing crashes or memory corruption.

Affected products (NVD): imagemagick imagemagick

Fixed in (NVD): 7.1.2-32

Weakness: CWE-476

Source: NVD CVE-2026-109280

References

• https://github.com/ImageMagick/ImageMagick/commit/fb743d60700c9bc350c3d2a0b48b998bdabc466c
• https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-v2x3-wpmg-c4w6
• https://www.vulncheck.com/advisories/imagemagick-7.1.0-20-before-7.1.2-32-use-after-free-via-fx-option

Check your software

Connect an AI agent to the FixLane MCP server or ask the Telegram bot to check what you have installed against incidents with a verified fixed version.