{"id":"CVE-2026-109271","summary":"ImageMagick 7.1.2-30 before 7.1.2-32 Use After Free in WBINFO Decoder","details":"ImageMagick 7.1.2-30 before 7.1.2-32 contains a use after free vulnerability in the WBINFO decoder that occurs when a memory allocation fails during image decoding. Attackers can supply a crafted image that, when decoded under memory allocation failure conditions, causes freed memory to be reused, crashing the application.","aliases":["GHSA-vxwm-jfjc-3r4x"],"modified":"2026-10-14T07:05:46.863108894Z","published":"2026-10-12T16:04:38.129Z","database_specific":{"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/109xxx/CVE-2026-109271.json","cna_assigner":"VulnCheck","cwe_ids":["CWE-415"]},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/109xxx/CVE-2026-109271.json"},{"type":"ADVISORY","url":"https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-vxwm-jfjc-3r4x"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109271"},{"type":"ADVISORY","url":"https://www.vulncheck.com/advisories/imagemagick-7.1.2-30-before-7.1.2-32-use-after-free-in-wbinfo-decoder"},{"type":"FIX","url":"https://github.com/ImageMagick/ImageMagick/commit/2ed1b96b9bc71434f0c4e82e3c63fec029c684c6"},{"type":"FIX","url":"https://github.com/ImageMagick/ImageMagick/commit/48c49d0cc2b72970b762e0d3263f6c35ab35a7b4"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/imagemagick/imagemagick","events":[{"introduced":"344e9056f43764bfdf82456faf3bc2feee98a6fe"},{"fixed":"ad98b244c995d2e3051757fa3b7855f45b550d24"},{"fixed":"2ed1b96b9bc71434f0c4e82e3c63fec029c684c6"},{"fixed":"48c49d0cc2b72970b762e0d3263f6c35ab35a7b4"}],"database_specific":{"source":["DESCRIPTION","REFERENCES"],"extracted_events":[{"introduced":"7.1.2-30"},{"fixed":"7.1.2-32"}]}}],"versions":["7.1.2-31","7.1.2-30"],"database_specific":{"vanir_signatures":[{"id":"CVE-2026-109271-3075cadb","signature_type":"Function","signature_version":"v1","source":"https://github.com/imagemagick/imagemagick/commit/2ed1b96b9bc71434f0c4e82e3c63fec029c684c6","target":{"function":"FreetypeAlloc","file":"MagickCore/annotate.c"},"deprecated":false,"digest":{"length":239,"function_hash":"167714581526402958326462779958215662195"}},{"source":"https://github.com/imagemagick/imagemagick/commit/48c49d0cc2b72970b762e0d3263f6c35ab35a7b4","target":{"function":"ReadToolTypesNewIcons","file":"coders/wbinfo.c"},"deprecated":false,"digest":{"function_hash":"40569770952063157471091267239224021914","length":3429},"id":"CVE-2026-109271-32a8d710","signature_type":"Function","signature_version":"v1"},{"id":"CVE-2026-109271-5b7b8c29","signature_type":"Function","signature_version":"v1","source":"https://github.com/imagemagick/imagemagick/commit/48c49d0cc2b72970b762e0d3263f6c35ab35a7b4","target":{"file":"MagickCore/string.c","function":"StringToStrings"},"deprecated":false,"digest":{"function_hash":"150187072243586912706889937710858799218","length":3174}},{"source":"https://github.com/imagemagick/imagemagick/commit/48c49d0cc2b72970b762e0d3263f6c35ab35a7b4","target":{"file":"coders/wbinfo.c"},"deprecated":false,"digest":{"line_hashes":["231785259878131566413843270447677177459","296601922103150536861951558659365660867","312699474200235661334431316596387849488","262922999719343766864939714030712120741","81013813916311701463803211048657463552","223721148987567004965763290702867702780","312699474200235661334431316596387849488","262922999719343766864939714030712120741"],"threshold":0.9},"id":"CVE-2026-109271-67ac3e6f","signature_type":"Line","signature_version":"v1"},{"source":"https://github.com/imagemagick/imagemagick/commit/2ed1b96b9bc71434f0c4e82e3c63fec029c684c6","target":{"file":"MagickCore/annotate.c","function":"FreetypeAcquireMemoryManager"},"deprecated":false,"digest":{"function_hash":"280574423537841341669261830823048635123","length":313},"id":"CVE-2026-109271-7df8c4c7","signature_type":"Function","signature_version":"v1"},{"source":"https://github.com/imagemagick/imagemagick/commit/2ed1b96b9bc71434f0c4e82e3c63fec029c684c6","target":{"function":"FreetypeRealloc","file":"MagickCore/annotate.c"},"deprecated":false,"digest":{"length":302,"function_hash":"322071533175308450081189290230490169164"},"id":"CVE-2026-109271-8c852295","signature_type":"Function","signature_version":"v1"},{"digest":{"line_hashes":["114672688045067591878665965898710284046","64593964685400897517903531006052684534","334927701735824614559534826273536339022","36353782111685115603470359303698790435","258442584311416242736137297099374328021","101284993553467756917218430537962856064","185208902578496547090138139952149885524","309020271488892601731152231592732492398","202204580672363372235634506096817876612","238989275225166806817457764844978725146","91398216718749529956389944857756574440","147295189406139059918508040555361930106","8807168888330303846880333588393486719","19337365004752007744162416851743848160","26967701691481699114861274107527675627","239869858207781194386455215776118648532","245398093871800479311571043109558266159","185208902578496547090138139952149885524","333544210363482856822320686705899044384","252064368632018452606837346219402159357","55127986456106171415876328131142536070","110903846060964196921372585217272481529","167462391285977548698621445767068870999","336655941949812832674432954063738292549","19711990053816735899176707305562097038","127744859572570134359161498308873838618","308573723254516629016832579172992371716","338273703235229745640426831641493695549"],"threshold":0.9},"id":"CVE-2026-109271-a11655b6","signature_type":"Line","signature_version":"v1","source":"https://github.com/imagemagick/imagemagick/commit/2ed1b96b9bc71434f0c4e82e3c63fec029c684c6","target":{"file":"MagickCore/annotate.c"},"deprecated":false},{"source":"https://github.com/imagemagick/imagemagick/commit/48c49d0cc2b72970b762e0d3263f6c35ab35a7b4","target":{"file":"MagickCore/string.c"},"deprecated":false,"digest":{"line_hashes":["198941647825457919934167415386291321823","205141620612583261968149415227764402586","132234513115181575673011240378339451769","67999147522404431042248932691814521138"],"threshold":0.9},"id":"CVE-2026-109271-bec9b5ef","signature_type":"Line","signature_version":"v1"}],"vanir_signatures_modified":"2026-10-14T07:05:46Z","source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-109271.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N"}]}