CVE-2026-109281: ImageMagick Heap Buffer Over-Read Flaw

CVE-2026-109281 Overview

CVE-2026-109281 is a heap buffer over-read vulnerability in ImageMagick, affecting versions 7.1.0-21 through versions before 7.1.2-32. The flaw resides in the handling of the -fx option within MagickCore/fx.c, where a specific -fx operation reads beyond the bounds of an allocated heap buffer. Attackers who can submit a crafted -fx expression for processing can read out-of-bounds heap memory. This may disclose limited contents of adjacent memory regions, potentially including sensitive data processed by the application. The weakness is classified under CWE-125: Out-of-bounds Read.

Critical Impact
Attackers supplying crafted -fx expressions can read adjacent heap memory, potentially exposing sensitive data processed by applications using ImageMagick.

Affected Products

ImageMagick 7.1.0-21
ImageMagick versions after 7.1.0-21 and before 7.1.2-32
Applications and services embedding vulnerable ImageMagick builds for image processing

Discovery Timeline

2026-10-12 - CVE-2026-109281 published to the National Vulnerability Database
2026-10-15 - Last updated in NVD database

Technical Details for CVE-2026-109281

Vulnerability Analysis

The vulnerability lives in ImageMagick's -fx expression evaluator, implemented in MagickCore/fx.c. The -fx option allows users to supply mathematical expressions that operate on image pixel data. During evaluation, the engine indexes into an internal array of image views using an image number. The indexing operation can reference a buffer position outside the allocated heap region when a specific expression pattern is processed.

Because the over-read occurs during pixel interpolation, each affected call can leak a small amount of heap memory into the output or into error paths. Repeated invocations with varied expressions can amplify this leakage. The flaw does not grant code execution, but it undermines confidentiality guarantees in image processing pipelines that accept untrusted expressions or filenames.

Root Cause

The root cause is incorrect indexing into the pfx->Imgs[] array when selecting an image view for pixel interpolation. The original code dereferenced pfx->Imgs[pfx->ImgNum].View, where pfx->ImgNum could resolve to an index outside the allocated element count under specific -fx operations. This produced a read past the end of the heap-allocated array of image view structures.

Attack Vector

Exploitation requires a local attacker with low privileges to submit a crafted -fx expression to a vulnerable ImageMagick binary or library. No user interaction is required. The attack surface expands significantly when server-side applications pass user-controlled input into ImageMagick operations without sanitization.

// Patch excerpt from MagickCore/fx.c
// Source: https://github.com/ImageMagick/ImageMagick/commit/0e82a4d0b294581186ed7b3e1dce59c858a73dba

   (void) GetPixelInfo (img, &pixelinf);

-  if (!InterpolatePixelInfo (img, pfx->Imgs[pfx->ImgNum].View, img->interpolate,
+  if (!InterpolatePixelInfo (img, pfx->Imgs[ImgNum].View, img->interpolate,
               (double) fx, (double) fy, &pixelinf, pfx->exception))
   {
     (void) ThrowMagickException (

The fix replaces pfx->ImgNum with the locally scoped ImgNum variable, ensuring the index used for pfx->Imgs[] references a validated position within allocation bounds.

Detection Methods for CVE-2026-109281

Indicators of Compromise

ImageMagick process invocations containing unusually complex or user-supplied -fx expressions in command-line arguments or API calls
Crash reports, segmentation faults, or AddressSanitizer heap-buffer-overflow warnings originating from MagickCore/fx.c
Unexpected image processing errors or anomalous output artifacts when processing user-supplied expressions

Detection Strategies

Inventory all systems running ImageMagick and verify versions against the vulnerable range 7.1.0-21 through pre-7.1.2-32
Review application logs for calls to convert, magick, or MagickWand APIs that forward untrusted input into -fx parameters
Deploy runtime instrumentation such as AddressSanitizer in staging environments to surface out-of-bounds reads during fuzzing

Monitoring Recommendations

Monitor ImageMagick execution telemetry for abnormal argument patterns, especially expressions referencing multiple images or unusual indices
Track process memory anomalies and crashes correlated with image upload or conversion endpoints
Alert on repeated failed image conversions from a single source, which may indicate exploitation attempts

How to Mitigate CVE-2026-109281

Immediate Actions Required

Upgrade ImageMagick to version 7.1.2-32 or later on all affected systems
Audit web applications and backend services that forward user-controlled strings into ImageMagick -fx arguments
Restrict ImageMagick execution contexts with least-privilege accounts and process isolation

Patch Information

The fix is committed upstream in the ImageMagick repository. Review the upstream commit 0e82a4d0 and the GitHub Security Advisory GHSA-cvgp-q487-j22w for release details. Additional background is available in the VulnCheck advisory.

Workarounds

Disable or block the -fx operator in ImageMagick's policy.xml configuration when the feature is not required
Reject or sanitize user-submitted expressions before passing them to ImageMagick command-line tools or bindings
Run ImageMagick inside a sandboxed container or seccomp profile to limit the impact of memory disclosure

bash

# Example policy.xml restriction to disable the -fx operator
# Place or edit in /etc/ImageMagick-7/policy.xml
<policymap>
  <policy domain="filter" rights="none" pattern="FX" />
</policymap>

# Verify installed version after upgrade
magick -version | head -n 1