{"id":"CVE-2026-109280","summary":"ImageMagick 7.1.0-20 before 7.1.2-32 Use After Free via -fx Option","details":"ImageMagick 7.1.0-20 before 7.1.2-32 contains a use after free vulnerability in the -fx option that occurs when a memory allocation fails during a specific operation. Attackers who can supply crafted -fx expressions under memory pressure can trigger freed memory access, causing crashes or memory corruption.","aliases":["GHSA-v2x3-wpmg-c4w6"],"modified":"2026-10-14T07:05:48.537563616Z","published":"2026-10-12T16:04:44.049Z","database_specific":{"cwe_ids":["CWE-476"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/109xxx/CVE-2026-109280.json","cna_assigner":"VulnCheck"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/109xxx/CVE-2026-109280.json"},{"type":"ADVISORY","url":"https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-v2x3-wpmg-c4w6"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109280"},{"type":"ADVISORY","url":"https://www.vulncheck.com/advisories/imagemagick-7.1.0-20-before-7.1.2-32-use-after-free-via-fx-option"},{"type":"FIX","url":"https://github.com/ImageMagick/ImageMagick/commit/fb743d60700c9bc350c3d2a0b48b998bdabc466c"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/imagemagick/imagemagick","events":[{"introduced":"660e30fd68a24d677adfa0d462962298d6b9fe34"},{"fixed":"ad98b244c995d2e3051757fa3b7855f45b550d24"},{"fixed":"fb743d60700c9bc350c3d2a0b48b998bdabc466c"}],"database_specific":{"source":["DESCRIPTION","REFERENCES"],"extracted_events":[{"introduced":"7.1.0-20"},{"fixed":"7.1.2-32"}]}}],"versions":["7.1.2-31","7.1.2-30","7.1.2-29","7.1.2-28","7.1.2-27","7.1.2-26","7.1.2-25","7.1.2-24","7.1.2-23","7.1.2-22","7.1.2-21","7.1.2-20","7.1.2-19","7.1.2-18","7.1.2-17","7.1.2-16","7.1.2-15","7.1.2-14","7.1.2-13","7.1.2-12","7.1.2-11","7.1.2-10","7.1.2-9","7.1.2-8","7.1.2-7","7.1.2-6","7.1.2-5","7.1.2-3","7.1.2-2","7.1.2-1","7.1.2-0","7.1.1-47","7.1.1-46","7.1.1-45","7.1.1-44","7.1.1-43","7.1.1-41","7.1.1-40","7.1.1-39","7.1.1-38","7.1.1-37","7.1.1-36","7.1.1-35","7.1.1-34","7.1.1-33","7.1.1-32","7.1.1-31","7.1.1-30","7.1.1-29","7.1.1-28","7.1.1-27","7.1.1-26","7.1.1-25","7.1.1-24","7.1.1-23","7.1.1-22","7.1.1-21","7.1.1-20","7.1.1-19","7.1.1-18","7.1.1-17","7.1.1-16","7.1.1-15","7.1.1-14","7.1.1-13","7.1.1-12","7.1.1-11","7.1.1-10","7.1.1-9","7.1.1-8","7.1.1-7","7.1.1-6","7.1.1-5","7.1.1-4","7.1.1-3","7.1.1-2","7.1.1-1","7.1.1-0","7.1.0-62","7.1.0-61","7.1.0-60","7.1.0-59","7.1.0-58","7.1.0-57","7.1.0-56","7.1.0-55","7.1.0-54","7.1.0-53","7.1.0-52","7.1.0-51","7.1.0-50","7.1.0-49","7.1.0-48","7.1.0-47","7.1.0-46","7.1.0-45","7.1.0-44","7.1.0-43","7.1.0-42","7.1.0-41","7.1.0-40","7.1.0-39","7.1.0-38","7.1.0-37","7.1.0-36","7.1.0-35","7.1.0-34","7.1.0-33","7.1.0-32","7.1.0-31","7.1.0-30","7.1.0-29","7.1.0-28","7.1.0-27","7.1.0-26","7.1.0-25","7.1.0-24","7.1.0-23","7.1.0-22","7.1.0-21","7.1.0-20"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-109280.json","vanir_signatures":[{"signature_type":"Function","signature_version":"v1","source":"https://github.com/imagemagick/imagemagick/commit/fb743d60700c9bc350c3d2a0b48b998bdabc466c","target":{"file":"MagickCore/fx.c","function":"AddElement"},"deprecated":false,"digest":{"length":1017,"function_hash":"120580787755886670461525784112047420231"},"id":"CVE-2026-109280-48206da4"},{"signature_version":"v1","source":"https://github.com/imagemagick/imagemagick/commit/fb743d60700c9bc350c3d2a0b48b998bdabc466c","target":{"file":"MagickCore/fx.c","function":"ExtendRPN"},"deprecated":false,"digest":{"length":451,"function_hash":"3471267275833388045603606042553799036"},"id":"CVE-2026-109280-5248c162","signature_type":"Function"},{"id":"CVE-2026-109280-fc3a3be2","signature_type":"Line","signature_version":"v1","source":"https://github.com/imagemagick/imagemagick/commit/fb743d60700c9bc350c3d2a0b48b998bdabc466c","target":{"file":"MagickCore/fx.c"},"deprecated":false,"digest":{"line_hashes":["27676347082919813530342650492745266717","285383893285938164078739587979950301335","226742925908618255645813736294562901901","96808943880727343185502667626926655641","191470758130765038822821680241397807291","315412532464130957955267120291167020995","26998246022863179405249812780806466427","239624465256748842759649331720145311415","71939319024073552901771531918934344335","339520794062363019843700325907715729883","186729162163232505066971262116426970119","331490324346946975932404049201387990345","87170312748082430318364715212892162766","214640556309463199455219283337811944245","107658756338908181223305271766493452693","147560323611078502201237303518486003996","326319007998804397878285739193624135399","111831137324249372187944134951545068579","10747191906377866974613677426081667487","114472985716314748994592992696446440269","288056156265868887507139021197431908503","268677581004535228322937036606964463073","12471154603789248667279256155533881929","15110675623853446015644807051663782634","53600923748890701695270649383724369117","149881082524670445324815181302978883164","122460283044965742018518897864459727116","315220477830100123389426343664922766852","23782465448137586463176574647872515925"],"threshold":0.9}}],"vanir_signatures_modified":"2026-10-14T07:05:48Z"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N"}]}