UpHeron
All vulnerabilities

Servers and applications

CVE-2026-109258

ImageMagick 7.1.0-20 before 7.1.2-32 Invalid Memory Free in FX Operation

Severity
Low 2.0
Published
12 Oct 2026
Last changed
3 Nov 2026
Added to UpHeron
3 Nov 2026
Fixed in
7.1.2-32
Sources
NVD, CVE Program

Description

ImageMagick 7.1.0-20 before 7.1.2-32 contains an invalid memory free vulnerability in the fx operation that occurs when initialization of an FX runtime entry fails. Attackers can trigger the failed FX runtime initialization to cause an invalid free, resulting in memory corruption and application crashes.

Affected software

SoftwareAffected versions
ImageMagickServers and applications · cna:imagemagick|imagemagick
  • From 7.1.0-20 before 7.1.2-32
ImageMagickServers and applications · cpe:a:imagemagick:imagemagick
  • From 7.1.0-20 before 7.1.2-32

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2026-109258
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2026-109258