CVE-2026-109281: 
ImageMagick vulnerability analysis and mitigation

CVE-2026-109281 is a heap buffer over-read vulnerability in ImageMagick's handling of the -fx option, where a specific -fx operation reads beyond the bounds of an allocated heap buffer, potentially disclosing limited heap memory contents. It affects ImageMagick versions 7.1.0-21 through 7.1.2-31 (fixed in 7.1.2-32). The vulnerability was published on October 12, 2026, with the GitHub Security Advisory (GHSA-cvgp-q487-j22w) originally published September 27, 2026. It carries a CVSS v3.1 base score of 4.4 (Medium) per NVD, and 4.8 (Medium) under CVSS v4.0 (Red Hat Advisory, GitHub Advisory).

The root cause is an out-of-bounds read (CWE-125) in MagickCore/fx.c, specifically in the GetIntensity function. The bug arises because the code incorrectly used pfx->ImgNum (a global/struct field) instead of the locally scoped ImgNum parameter when indexing into the pfx->Imgs[] array via InterpolatePixelInfo, causing reads beyond the intended buffer boundary under certain -fx expression conditions. The fix, applied in commit 0e82a4d, is a one-line change replacing pfx->ImgNum with ImgNum in the affected call (GitHub Commit, GitHub Advisory). Exploitation requires a local attacker with low privileges to supply a crafted -fx expression to an ImageMagick process (Red Hat Bugzilla).

Successful exploitation results in limited heap memory disclosure — an attacker can read out-of-bounds heap memory contents, posing a low confidentiality impact with no integrity or availability impact on the system itself. The attack is local in scope, requiring the attacker to already have low-privileged access to the system and the ability to influence -fx expression processing. There is no evidence of lateral movement potential or significant data exposure beyond incidental heap contents (GitHub Advisory, Red Hat Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time (Red Hat Advisory). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, and the EPSS score is reported as 0.0, indicating very low probability of exploitation in the near term. The vulnerability was reported by researcher Yanhaoxi and requires local access with low privileges, limiting its practical attack surface (GitHub Advisory).

1. Gain local access: Obtain a low-privileged local account on a system running a vulnerable version of ImageMagick (7.1.0-21 through 7.1.2-31).
2. Craft a malicious -fx expression: Construct a specific -fx expression that triggers the incorrect image index lookup in GetIntensity, causing InterpolatePixelInfo to reference an out-of-bounds Imgs[] entry.
3. Invoke ImageMagick: Execute a command such as convert input.png -fx '<crafted_expression>' output.png to trigger the heap over-read.
4. Observe memory disclosure: Depending on heap layout, limited adjacent heap memory contents may be disclosed through the processing output or error output, potentially revealing sensitive data from the process heap (GitHub Advisory, GitHub Commit).

The primary remediation is to upgrade ImageMagick to version 7.1.2-32 or later, which contains the one-line fix in MagickCore/fx.c (GitHub Commit). As a workaround where upgrading is not immediately possible, restrict or disable use of the -fx option, and apply the principle of least privilege to limit which users can invoke ImageMagick operations. Organizations should also consider restricting access to ImageMagick image processing capabilities in multi-user or web-facing environments (Red Hat Advisory, Red Hat Bugzilla).

The vulnerability was assigned a "Low" severity rating by the ImageMagick project maintainer (dlemstra) in the GitHub Security Advisory, with a CVSS v3 score of 2.5 under the advisory's own scoring — notably lower than the NVD's 4.4 assessment, reflecting the high attack complexity and required user interaction in the advisory's view (GitHub Advisory). Red Hat triaged the issue at medium priority/severity and opened a tracking bug (Red Hat Bugzilla). No significant broader community or media discussion has been observed.