CVE-2026-109280: ImageMagick Use After Free Vulnerability

CVE-2026-109280 Overview

CVE-2026-109280 is a use-after-free vulnerability in ImageMagick 7, affecting versions 7.1.0-20 through 7.1.2-32. The flaw resides in the -fx option handler within MagickCore/fx.c. When a memory allocation fails during expression evaluation under memory pressure, the code accesses freed memory. Attackers who can submit crafted -fx expressions can trigger crashes or memory corruption. The weakness is tracked under [CWE-476] related improper resource handling after allocation failure.

Critical Impact
Local attackers supplying crafted -fx expressions can cause ImageMagick to access freed memory, resulting in process crashes or potential memory corruption on systems processing untrusted image operations.

Affected Products

ImageMagick 7.1.0-20
ImageMagick versions prior to 7.1.2-32
Applications and services embedding vulnerable ImageMagick builds for -fx expression processing

Discovery Timeline

2026-10-12 - CVE-2026-109280 published to NVD
2026-10-15 - Last updated in NVD database

Technical Details for CVE-2026-109280

Vulnerability Analysis

The vulnerability exists in the ExtendRPN function in MagickCore/fx.c, which grows the Reverse Polish Notation (RPN) element table used by the -fx expression evaluator. The original implementation reassigned pfx->Elements with the result of ResizeMagickMemory and simultaneously updated pfx->numElements before confirming the resize succeeded. When the resize returns NULL under memory pressure, the pointer field is overwritten and subsequent code paths dereference an invalid or freed region. The result is a crash or memory corruption during evaluation of attacker-supplied -fx arithmetic.

Root Cause

The root cause is unsafe handling of a failed allocation. ResizeMagickMemory can release the original buffer when it cannot satisfy the request, leaving the caller with a dangling pointer. The pre-patch code did not preserve the original table or detect allocation failure before mutating state, violating the invariant that structure fields must remain valid after an error path.

Attack Vector

Exploitation requires local access and the ability to pass a crafted -fx expression to a vulnerable ImageMagick binary or library consumer. The attacker must also induce memory pressure so the allocation inside ExtendRPN fails. Successful exploitation yields a use-after-free condition that typically manifests as a crash but may be weaponized into limited memory corruption.

   return MagickTrue;
 }
 
-static MagickBooleanType ExtendRPN (FxInfo * pfx)
+static MagickBooleanType ExtendRPN(FxInfo * pfx)
 {
-  pfx->numElements = (int) ceil (pfx->numElements * (1 + TableExtend));
-  pfx->Elements = (ElementT*) ResizeMagickMemory (pfx->Elements, (size_t) pfx->numElements * sizeof(ElementT));
-  if (!pfx->Elements) {
-    (void) ThrowMagickException (
-      pfx->exception, GetMagickModule(), ResourceLimitFatalError,
-      "Elements", "%i",
-      pfx->numElements);
-    return MagickFalse;
-  }
-  return MagickTrue;
+  ElementT
+    *new_elements;
+
+  size_t
+    element_count;
+
+  /*
+    Keep the original table and size intact unless growth succeeds.
+  */
+  element_count=(size_t) ceil(pfx->numElements*(1+TableExtend));
+  new_elements=(ElementT *) AcquireQuantumMemory((size_t) element_count,
+    sizeof(*new_elements));
+  if (new_elements == (ElementT *) NULL)
+    {

Source: ImageMagick patch commit fb743d6. The patch introduces a separate new_elements pointer and preserves the original table and element count until the new allocation is confirmed successful.

Detection Methods for CVE-2026-109280

Indicators of Compromise

Unexpected crashes of magick, convert, or linked ImageMagick processes when evaluating -fx expressions
Core dumps referencing ExtendRPN or fx.c call frames
ResourceLimitFatalError entries in ImageMagick logs correlated with process termination

Detection Strategies

Inventory installed ImageMagick packages and flag versions between 7.1.0-20 and 7.1.2-32
Review command-line auditing (auditd, Sysmon) for processes invoking ImageMagick with -fx arguments from untrusted sources
Monitor web and conversion services for repeated crashes tied to image processing workers

Monitoring Recommendations

Enable crash reporting (systemd-coredump, ABRT) on hosts running ImageMagick in automated pipelines
Alert on anomalous memory consumption spikes in processes that embed MagickCore
Track SBOM data for ImageMagick dependencies in container images and application bundles

How to Mitigate CVE-2026-109280

Immediate Actions Required

Upgrade ImageMagick to version 7.1.2-32 or later across all hosts and container images
Audit automation and web services for exposure to attacker-controlled -fx expressions
Rebuild and redeploy applications statically linked against vulnerable MagickCore builds

Patch Information

The fix is published in the ImageMagick Security Advisory GHSA-v2x3-wpmg-c4w6 and implemented in commit fb743d6. Additional context is available in the VulnCheck advisory. The patch replaces in-place reallocation with a staged allocation using AcquireQuantumMemory, preserving the original table until the new buffer is validated.

Workarounds

Disable or restrict the -fx option by removing it from allowed operations in ImageMagick policy.xml
Enforce resource limits (MAGICK_MEMORY_LIMIT, MAGICK_MAP_LIMIT) to reduce exploitable memory-pressure conditions
Sanitize or reject user-supplied -fx expressions in applications that invoke ImageMagick

bash

# /etc/ImageMagick-7/policy.xml - disable the -fx operator
<policymap>
  <policy domain="filter" rights="none" pattern="FX" />
  <policy domain="resource" name="memory" value="256MiB" />
  <policy domain="resource" name="map" value="512MiB" />
</policymap>