CVE-2026-109258
ImageMagick 7.1.0-20 before 7.1.2-32 Invalid Memory Free in FX Operation
CVSS Score
2.5
EPSS Score
0.0%
EPSS Percentile
0th
ImageMagick 7.1.0-20 before 7.1.2-32 contains an invalid memory free vulnerability in the fx operation that occurs when initialization of an FX runtime entry fails. Attackers can trigger the failed FX runtime initialization to cause an invalid free, resulting in memory corruption and application crashes.
| CWE | CWE-476 |
| Vendor | imagemagick |
| Product | imagemagick |
| Published | Oct 12, 2026 |
Stay Ahead of the Next One
Get instant alerts for imagemagick imagemagick
Be the first to know when new low vulnerabilities affecting imagemagick imagemagick are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L Attack Vector
Local
Attack Complexity
High
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
Low
Affected Versions
ImageMagick / ImageMagick
7.1.0-20 < 7.1.2-32
References
github.com: https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-pv8x-gq6w-gp4r github.com: https://github.com/ImageMagick/ImageMagick/commit/8caa6a0c62a3ac1f81b19a2ee929fbfe46ee0323 vulncheck.com: https://www.vulncheck.com/advisories/imagemagick-7.1.0-20-before-7.1.2-32-invalid-memory-free-in-fx-operation
Credits
🔍 w226688