CVE-2026-109280: 
ImageMagick vulnerability analysis and mitigation

CVE-2026-109280 is a use-after-free vulnerability in ImageMagick's -fx option that is triggered when a memory allocation fails during a specific RPN (Reverse Polish Notation) table extension operation. It affects ImageMagick versions 7.1.0-20 through 7.1.2-31 (fixed in 7.1.2-32). The vulnerability was published on October 12, 2026, and was reported by researcher Yanhaoxi. It carries a CVSS v3.1 base score of 2.5 (Low) and a CVSS v4.0 base score of 2.0 (Low) (GitHub Advisory, Red Hat Bugzilla).

The root cause is classified as CWE-476 (NULL Pointer Dereference) and CWE-825 (Expired Pointer Dereference). The vulnerable code resides in MagickCore/fx.c within the ExtendRPN() function, which previously used ResizeMagickMemory() to resize the RPN elements table in-place. If the reallocation failed, the original pointer was freed but still referenced, creating a use-after-free condition. The fix replaces the in-place resize with a safe allocate-copy-free pattern using AcquireQuantumMemory() and memcpy(), preserving the original buffer until the new allocation succeeds (GitHub Advisory, GitHub Commit). Exploitation requires local access, low privileges, and the system to be under memory pressure — making the attack complexity high (Red Hat Bugzilla).

Successful exploitation results in a denial of service through process crash or memory corruption when ImageMagick processes a crafted -fx expression under memory pressure. There is no impact on confidentiality or integrity; the availability impact is limited to the affected ImageMagick process. The vulnerability does not enable remote code execution, privilege escalation, or lateral movement based on current analysis (GitHub Advisory, Red Hat Bugzilla).

There is no known public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the publication date. The EPSS score is 0.0, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation is constrained by the requirement for local access, low privileges, and specific memory pressure conditions, significantly limiting practical attack scenarios (GitHub Advisory, Red Hat Bugzilla).

The primary remediation is to upgrade ImageMagick to version 7.1.2-32 or later, which contains the patched ExtendRPN() function (GitHub Commit). If immediate patching is not feasible, administrators should restrict local access to ImageMagick processes, avoid processing untrusted -fx expressions, and consider disabling the -fx option if it is not required for operations. Monitoring system memory pressure conditions can also reduce the likelihood of triggering the vulnerability (Red Hat Bugzilla).

The vulnerability was published by maintainer dlemstra via the official ImageMagick GitHub Security Advisory and credited to reporter Yanhaoxi. Red Hat tracked it via their Bugzilla system with a low severity rating, and VulnCheck assigned the CVE identifier. No significant broader media coverage or notable community discussion has been observed, consistent with the low severity and limited exploitability of the issue (GitHub Advisory, Red Hat Bugzilla).