CVE-2026-109258

2.5Low

Published 12 Oct 2026 · NVD status: Awaiting Analysis · AI triage by gemini-3.8-flash

2.5Low

Attack vector: Local
Complexity: High
Privileges needed: Low
User interaction: None
Impact: Limited impact
Weakness: CWE-476

Impact

A local attacker with an account can crash ImageMagick applications and cause memory corruption by triggering a failed FX runtime entry initialization. Exploitation results in denial of service without code execution or data exposure.

Root cause

The fx operation attempts an invalid memory free when initialization of an FX runtime entry fails.

Affected systems

ImageMagick 7.1.0-20 before 7.1.2-32

CVSS v3.1 · CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L

Fix & remediation

Upgrade ImageMagick to version 7.1.2-32 or later; no interim workaround or configuration mitigation is documented.

shell

$ sudo apt-get update && sudo apt-get install --only-upgrade imagemagick

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

ImageMagick 7.1.0-20 before 7.1.2-32 contains an invalid memory free vulnerability in the fx operation that occurs when initialization of an FX runtime entry fails. Attackers can trigger the failed FX runtime initialization to cause an invalid free, resulting in memory corruption and application crashes.

References

Source: nvd.nist.gov/vuln/detail/CVE-2026-109258