CVE-2026-109271: ImageMagick Use After Free Vulnerability

CVE-2026-109271 Overview

CVE-2026-109271 is a use-after-free vulnerability [CWE-415] in the WBINFO decoder of ImageMagick 7. The flaw affects versions 7.1.2-30 before 7.1.2-32 and is triggered when a memory allocation fails during image decoding. An attacker who supplies a crafted image can cause freed memory to be reused, leading to application crashes and potential denial of service in services that process untrusted images.

Critical Impact
A crafted image processed by a vulnerable ImageMagick build can trigger memory reuse in the WBINFO decoder path and crash the host application or service.

Affected Products

ImageMagick 7.1.2-30
ImageMagick 7.1.2-31
Downstream applications and services bundling the vulnerable ImageMagick builds

Discovery Timeline

2026-10-12 - CVE-2026-109271 published to NVD
2026-10-15 - Last updated in NVD database

Technical Details for CVE-2026-109271

Vulnerability Analysis

The vulnerability resides in the WBINFO coder (coders/wbinfo.c) within ImageMagick. During image decoding, the coder resizes an internal array of per-line pointers (im1_lines). If the resize call returns NULL, the function sets a resource-failure flag and breaks out of the loop. However, the stale pointer to the previously freed buffer remained accessible, allowing subsequent cleanup logic to reuse memory that had already been released.

A related issue exists in MagickCore/string.c, where a failed reallocation path destroyed textlist[i] while leaving the entry addressable to later cleanup code. Both sites follow the same pattern: on allocation failure, pointer bookkeeping is not reset to NULL before the next access.

Because ImageMagick is embedded in web applications, document pipelines, and server-side thumbnailing stacks, exploitation can be reached remotely by any workflow that accepts user-controlled images.

Root Cause

The root cause is incorrect pointer hygiene after an allocation failure. The affected code paths freed memory or released the backing buffer but did not clear the owning pointer. Later deallocation or indexing operations then operated on freed memory, producing a use-after-free condition classified under [CWE-415].

Attack Vector

Exploitation requires an attacker to deliver a crafted image to a vulnerable ImageMagick instance under conditions that provoke memory allocation failure during WBINFO decoding. Any network-facing service that converts, inspects, or renders attacker-controlled images using the vulnerable library is a candidate target. No authentication or user interaction is required beyond image submission.

// Patch excerpt from coders/wbinfo.c - clear dangling pointer on allocation failure
              sizeof(*im1_lines));
            if (new_lines == (char **) NULL)
              {
+                im1_lines=(char **) NULL;
                 tooltypes_resource_failure=MagickTrue;
                 break;
              }

Source: GitHub Commit 48c49d0

// Companion fix in MagickCore/string.c
             textlist[i]+1),sizeof(**textlist));
           if (resized == (char *) NULL)
             {
-              textlist[i]=DestroyString(textlist[i]);
+              textlist[i]=(char *) NULL;
               for (j=0; j < i; j++)
                 textlist[j]=DestroyString(textlist[j]);
               textlist=(char **) RelinquishMagickMemory(textlist);

Source: GitHub Commit 48c49d0

Detection Methods for CVE-2026-109271

Indicators of Compromise

Unexpected crashes or segmentation faults from processes invoking ImageMagick (convert, magick, identify) when handling user-supplied images.
Core dumps that reference the WBINFO coder or ReadWBINFOImage call frames.
Image upload workflows producing HTTP 500 responses correlated with WBINFO/WBMP-related file inputs.

Detection Strategies

Inventory hosts running ImageMagick 7.1.2-30 or 7.1.2-31 using software composition analysis or package manager queries.
Enable AddressSanitizer or Valgrind in pre-production image processing stages to surface use-after-free conditions during fuzz testing.
Alert on repeated child-process crashes of image conversion services within a short time window.

Monitoring Recommendations

Monitor application logs for ImageMagick exception traces referencing wbinfo.c or allocation failures.
Track memory pressure on image conversion workers, since the bug triggers only when allocations fail.
Capture and retain samples of input images that precede worker crashes for forensic analysis.

How to Mitigate CVE-2026-109271

Immediate Actions Required

Upgrade ImageMagick to version 7.1.2-32 or later across all systems that decode untrusted images.
Audit all services, container images, and build pipelines for bundled copies of ImageMagick.
Restrict the enabled coders in policy.xml to only those required by the application.

Patch Information

The issue is fixed in ImageMagick 7.1.2-32. The relevant upstream fixes are published as GitHub Commit 2ed1b96 and GitHub Commit 48c49d0. Full details are available in the GitHub Security Advisory GHSA-vxwm-jfjc-3r4x and the VulnCheck Advisory.

Workarounds

Disable the WBINFO coder in ImageMagick's policy.xml until the patch can be deployed.
Reject uploads with WBMP-related file extensions or magic bytes at the application boundary.
Enforce memory and resource limits per image conversion worker to reduce the blast radius of a crash.

bash

# Disable the WBINFO coder in /etc/ImageMagick-7/policy.xml
<policymap>
  <policy domain="coder" rights="none" pattern="WBINFO" />
  <policy domain="coder" rights="none" pattern="WBMP" />
</policymap>

# Verify the installed version is patched
magick -version | head -n 1