CVE-2026-109281

Name of the Vulnerable Software and Affected Versions ImageMagick versions 7.1.0-21 through 7.1.2-31

Description A heap buffer over-read exists in the handling of the -fx option. This occurs when a specific -fx operation reads beyond the boundaries of an allocated heap buffer. An attacker can provide a crafted -fx expression to read out-of-bounds heap memory, which may lead to the disclosure of limited memory contents.

Recommendations Update ImageMagick to version 7.1.2-32 or later. As a temporary mitigation, avoid using the -fx option with untrusted input.