CVE-2026-109258: ImageMagick Use-After-Free Vulnerability

CVE-2026-109258 Overview

CVE-2026-109258 is an invalid memory free vulnerability affecting ImageMagick 7 versions 7.1.0-20 through 7.1.2-32. The flaw resides in the fx operation inside MagickCore/fx.c and triggers when initialization of an FX runtime entry fails. When this initialization fails, the cleanup loop releases memory using an incorrect index, producing an invalid free. Attackers with local access can abuse this condition to corrupt memory and crash the application. The vulnerability is categorized under CWE-476 and requires local access with limited privileges, which constrains its practical attack surface.

Critical Impact
Local attackers can trigger an invalid free in ImageMagick's FX runtime, causing memory corruption and process termination that disrupts image-processing workflows.

Affected Products

ImageMagick 7.1.0-20 (initial affected version)
ImageMagick releases prior to 7.1.2-32
Applications and services embedding vulnerable MagickCore/fx.c

Discovery Timeline

2026-10-12 - CVE-2026-109258 published to NVD
2026-10-13 - Last updated in NVD database

Technical Details for CVE-2026-109258

Vulnerability Analysis

The vulnerability affects the FX expression evaluator in ImageMagick's MagickCore/fx.c. The FX module allocates an array of fxRtT runtime entries (pfx->fxrts) and initializes them in a loop. If initialization of any entry fails partway through, the error-handling path attempts to tear down the entries already created. The cleanup loop uses the wrong index variable when calling DestroyFxRt, releasing memory associated with an uninitialized or out-of-range slot. The resulting invalid free corrupts the heap and typically causes the process to abort.

Root Cause

The root cause is an index mismatch in the cleanup path. The outer loop variable t tracks the current initialization step, while the inner cleanup loop variable t2 iterates backward over successfully initialized entries. The pre-patch code called DestroyFxRt(&pfx->fxrts[t]) instead of DestroyFxRt(&pfx->fxrts[t2]), repeatedly freeing the same uninitialized slot rather than the valid entries at index t2. This maps to [CWE-476] class memory-safety behavior associated with mishandled error paths.

Attack Vector

Exploitation requires local access and the ability to submit a crafted FX expression or image to a process that uses ImageMagick. The attacker influences the FX runtime initialization to fail, which drives execution into the faulty cleanup loop. Successful triggering produces heap corruption and application termination. The CVSS 4.0 vector indicates no confidentiality or integrity impact and only limited availability impact on the vulnerable component.

         {
           ssize_t t2;
           for (t2 = t-1; t2 >= 0; t2--) {
-            DestroyFxRt (&pfx->fxrts[t]);
+            DestroyFxRt (&pfx->fxrts[t2]);
           }
         }
         pfx->fxrts = (fxRtT *) RelinquishMagickMemory (pfx->fxrts);
// Source: https://github.com/ImageMagick/ImageMagick/commit/8caa6a0c62a3ac1f81b19a2ee929fbfe46ee0323

The patch replaces the incorrect index t with t2, ensuring the cleanup loop destroys only the FX runtime entries that were successfully initialized.

Detection Methods for CVE-2026-109258

Indicators of Compromise

Unexpected crashes or SIGABRT signals in processes linking against libMagickCore when evaluating FX expressions.
Core dumps referencing DestroyFxRt or RelinquishMagickMemory in the call stack.
Submission of images or scripts containing unusually complex or malformed FX expressions prior to a crash.

Detection Strategies

Inventory installed ImageMagick packages and flag any version between 7.1.0-20 and 7.1.2-31 inclusive.
Monitor process exit codes and crash telemetry for ImageMagick-dependent services such as web upload handlers and media pipelines.
Review application logs for FX-related errors emitted by MagickCore immediately before process termination.

Monitoring Recommendations

Enable heap-corruption telemetry such as glibc MALLOC_CHECK_ or AddressSanitizer in test environments to confirm patch effectiveness.
Correlate repeated crashes of image-processing workers with the originating user or upload source to identify abuse attempts.
Track package-management events that install or downgrade ImageMagick on production hosts.

How to Mitigate CVE-2026-109258

Immediate Actions Required

Upgrade ImageMagick to version 7.1.2-32 or later on all affected systems.
Rebuild and redeploy any applications that statically link vulnerable MagickCore code.
Restrict local accounts permitted to submit FX expressions to trusted operators only.

Patch Information

The fix is published in upstream commit 8caa6a0c and documented in the GitHub Security Advisory GHSA-pv8x-gq6w-gp4r. Additional context is available in the Vulncheck advisory for ImageMagick FX invalid free. The patch corrects the index used by the FX runtime cleanup loop, eliminating the invalid free.

Workarounds

Disable or restrict the FX operator through an ImageMagick policy.xml policy entry.
Reject user-supplied FX expressions at the application layer until patched binaries are deployed.
Run ImageMagick inside a sandbox or container with resource limits to contain crash impact.

bash

# /etc/ImageMagick-7/policy.xml - block the fx operator
<policymap>
  <policy domain="filter" rights="none" pattern="FX" />
</policymap>