ImageMagick 7.1.0-21 before 7.1.2-32 contains a heap buffer over-read in its handling of the -fx option, where a certain -fx operation reads beyond… (CVE-2026-109281)

CVE-2026-109281 is a heap buffer over-read vulnerability in ImageMagick's -fx option processing. Specifically, certain -fx operations can read beyond the bounds of an allocated heap buffer under specific conditions, leading to potential disclosure of limited heap memory contents. This vulnerability affects ImageMagick versions starting from 7.1.0-21 up to but excluding 7.1.2-32. The CVSS 3.1 base score is 4.4, indicating medium severity, with local attack vector, low complexity, requiring low privileges and no user interaction. The impact is limited to confidentiality loss of memory contents. No known exploits have been reported. The vulnerability is identified as CWE-125 (Out-of-bounds Read).

An attacker with the ability to supply a crafted -fx expression to ImageMagick can cause the application to read beyond allocated heap memory, potentially disclosing limited sensitive information from memory. The impact is limited to confidentiality and does not affect integrity or availability beyond minor impact. No active exploitation is known.

Upgrade ImageMagick to version 7.1.2-32 or later, where this heap buffer over-read vulnerability has been fixed. Until then, avoid processing untrusted -fx expressions. Patch status is confirmed by the version range indicating the fix in 7.1.2-32.