Description
ImageMagick 7.1.0-20 before 7.1.2-32 contains an invalid memory free vulnerability in the fx operation that occurs when initialization of an FX runtime entry fails. Attackers can trigger the failed FX runtime initialization to cause an invalid free, resulting in memory corruption and application crashes.
Published: 2026-10-12
Score: 2 Low
EPSS: < 1% Very Low
KEV: No
Impact: Memory corruption and application crashes
Action: Patch
AI Analysis

Impact

ImageMagick versions 7.1.0-20 through 7.1.2-31 contain an invalid memory free flaw in the fx operation. When FX runtime initialization fails, the implementation attempts to free an invalid pointer, causing memory corruption that can lead to application crashes. The flaw is classified as CWE-476 and is also associated with CWE-763.

Affected Systems

The vulnerability affects the ImageMagick product from the ImageMagick vendor. All releases from version 7.1.0-20 up to but not including 7.1.2-32 are impacted. Users running any of these builds may experience crashes or memory corruption when processing images that trigger the faulty FX path.

Risk and Exploitability

The CVSS score of 2 denotes low severity, and no EPSS score is provided. The vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is via malicious input that forces the FX runtime initialization to fail, which could be achieved locally or through a crafted image processed by ImageMagick. The low severity and limited attack surface result in a relatively low overall risk.

Generated by OpenCVE AI on October 13, 2026 at 01:29 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade ImageMagick to version 7.1.2-32 or later.
  • If an upgrade is not possible, disable or limit the use of the FX operation in affected workflows.
  • Monitor ImageMagick security advisories for updates.

Generated by OpenCVE AI on October 13, 2026 at 01:29 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 13 Oct 2026 16:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 13 Oct 2026 00:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-763
References
Metrics threat_severity

None

 threat_severity

Low

Mon, 12 Oct 2026 16:30:00 +0000

Type Values Removed Values Added
Description ImageMagick 7.1.0-20 before 7.1.2-32 contains an invalid memory free vulnerability in the fx operation that occurs when initialization of an FX runtime entry fails. Attackers can trigger the failed FX runtime initialization to cause an invalid free, resulting in memory corruption and application crashes.
Title ImageMagick 7.1.0-20 before 7.1.2-32 Invalid Memory Free in FX Operation
First Time appeared Imagemagick
Imagemagick imagemagick
Weaknesses CWE-476
CPEs cpe:2.3:a:imagemagick:imagemagick:*:*:*:*:*:*:*:*
Vendors & Products Imagemagick
Imagemagick imagemagick
References
Metrics cvssV3_1

{'score': 2.5, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L'}

cvssV4_0

{'score': 2, 'vector': 'CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N'}

Subscriptions

Imagemagick Imagemagick
cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-10-13T15:30:50.719Z

Reserved: 2026-10-12T14:10:14.200Z

Link: CVE-2026-109258

cve-icon Vulnrichment

Updated: 2026-10-13T15:30:40.579Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-10-12T17:17:17.427

Modified: 2026-10-13T20:39:48.767

Link: CVE-2026-109258

cve-icon Redhat

Severity : Low

Publid Date: 2026-10-12T16:04:28Z

Links: CVE-2026-109258 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-10-13T07:00:04Z

Weaknesses
  • CWE-476

    NULL Pointer Dereference

  • CWE-763

    Release of Invalid Pointer or Reference