CVE-2026-109258 ImageMagick 7.1.0-20 before 7.1.2-32 Invalid Memory Free in FX Operation
Attackers can trigger an invalid memory free in ImageMagick's FX operation, causing crashes or potential code execution via crafted images.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-109258?
CVE-2026-109258 is a low-severity use after free vulnerability in ImageMagick, published on 12 Oct 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
ImageMagick 7.1.0-20 before 7.1.2-32 contains an invalid memory free vulnerability in the fx operation that occurs when initialization of an FX runtime entry fails. Attackers can trigger the failed FX runtime initialization to cause an invalid free, resulting in memory corruption and application crashes.
Weakness: CWE-476
Which versions are affected by CVE-2026-109258?
How do I fix CVE-2026-109258?
Upgrade to a fixed version.
Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.
Is CVE-2026-109258 being exploited?
There is no known exploitation of CVE-2026-109258 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2026-109258, ECHO-29b5-7010-50b8, GHSA-pv8x-gq6w-gp4r, GHSA-qr3h-jrh3-5m34, UBUNTU-CVE-2026-109258.