What’s Vulnerable › Vulnerabilities

CVE-2026-109258: ImageMagick 7.1.0-20 before 7.1.2-32 Invalid Memory Free in FX Operation

• Severity: low (CVSS 2.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.1% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-10-12 · updated 2026-10-13
• Weakness: CWE-476

Description

ImageMagick 7.1.0-20 before 7.1.2-32 contains an invalid memory free vulnerability in the fx operation that occurs when initialization of an FX runtime entry fails. Attackers can trigger the failed FX runtime initialization to cause an invalid free, resulting in memory corruption and application crashes.

Affected products

• ImageMagick: from 7.1.0-20 before 7.1.2-32 — fixed in 7.1.2-32

How to fix

Upgrade to a fixed version: ImageMagick 7.1.2-32. Check the vendor advisory for mitigations.

References

• https://github.com/ImageMagick/ImageMagick/commit/8caa6a0c62a3ac1f81b19a2ee929fbfe46ee0323
• https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-pv8x-gq6w-gp4r
• https://www.vulncheck.com/advisories/imagemagick-7.1.0-20-before-7.1.2-32-invalid-memory-free-in-fx-operation

Get alerted when CVE-2026-109258 or the next vulnerability affects your stack