CVE-2026-109281

4.4Medium

Published 12 Oct 2026 · NVD status: Awaiting Analysis · AI triage by gemini-3.8-flash

4.4Medium

Attack vector: Local
Complexity: Low
Privileges needed: Low
User interaction: None
Impact: Limited impact
Weakness: CWE-125

Impact

A local attacker can read out-of-bounds heap memory and potentially crash the process by providing a crafted -fx expression. They need existing local access or the ability to pass arbitrary -fx operations into ImageMagick processing.

Root cause

A heap buffer over-read occurs when processing specific operations passed to the -fx command-line option.

Affected systems

ImageMagick 7.1.0-21 before 7.1.2-32

CVSS v3.1 · CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L

Fix & remediation

Upgrade ImageMagick to version 7.1.2-32 or newer. As an interim workaround, prevent untrusted user input from reaching the -fx option.

shell

$ magick -version

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

ImageMagick 7.1.0-21 before 7.1.2-32 contains a heap buffer over-read in its handling of the -fx option, where a certain -fx operation reads beyond the bounds of an allocated heap buffer in specific situations. Attackers who can get a crafted -fx expression processed can read out-of-bounds heap memory, potentially disclosing limited memory contents.

References

Source: nvd.nist.gov/vuln/detail/CVE-2026-109281