CVE-2026-109258GHSA-pv8x-gq6w-gp4r
ImageMagick 7.1.0-20 before 7.1.2-32 Invalid Memory Free in FX Operation
ImageMagick ImageMagickLibraries & packages
CVSS
2.0LowExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.11%Chance of exploitation activity in the next 30 days, higher than 1% of CVEs. Scored 23 Oct 2026FIRST EPSS
What fixes it
- 7.1.2-32ImageMagickCVE List
A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.
Description
ImageMagick 7.1.0-20 before 7.1.2-32 contains an invalid memory free vulnerability in the fx operation that occurs when initialization of an FX runtime entry fails. Attackers can trigger the failed FX runtime initialization to cause an invalid free, resulting in memory corruption and application crashes.
Text from CVE List
Affected versions 2
- ImageMagickaffected: 7.1.0-20 before 7.1.2-32CVE List
- ImageMagickunaffected: 7.1.2-32CVE List
References 3
- github.com/ImageMagick/ImageMagick/commit/8caa6a0c62a3ac1f81b19a2ee929fbfe46ee0323Fixvia CVE List
- github.com/ImageMagick/ImageMagick/security/advisories/GHSA-pv8x-gq6w-gp4rAdvisoryvia CVE List
- vulncheck.com/advisories/imagemagick-7.1.0-20-before-7.1.2-32-invalid-memory-free-in-fx-operationAdvisoryvia CVE List