CVE-2026-109258

2.5 LOWpublic exploit available

Published 2026-10-12 · Updated 2026-10-13

AI analysis for this CVE has not been generated yet. Raw NVD data is shown below.

NVD description

ImageMagick 7.1.0-20 before 7.1.2-32 contains an invalid memory free vulnerability in the fx operation that occurs when initialization of an FX runtime entry fails. Attackers can trigger the failed FX runtime initialization to cause an invalid free, resulting in memory corruption and application crashes.

CVSS vector

CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L

Weaknesses

CWE-476

Public exploit & PoC references

https://github.com/ImageMagick/ImageMagick/commit/8caa6a0c62a3ac1f81b19a2ee929fbfe46ee0323
https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-pv8x-gq6w-gp4r

All references

https://github.com/ImageMagick/ImageMagick/commit/8caa6a0c62a3ac1f81b19a2ee929fbfe46ee0323
https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-pv8x-gq6w-gp4r
https://www.vulncheck.com/advisories/imagemagick-7.1.0-20-before-7.1.2-32-invalid-memory-free-in-fx-operation

Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.

Related CVEs

UNSCOREDCVE-2025-29895
UNSCOREDCVE-2025-29896
MEDIUMCVE-2026-100348PoC
UNSCOREDCVE-2026-100349PoC
HIGHCVE-2026-100353PoC
MEDIUMCVE-2026-100394PoC
MEDIUMCVE-2026-100890
MEDIUMCVE-2026-100895PoC

Related by shared AI tags and CWE weakness class. Browse the full archive.