CVE-2026-109281

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-109281
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-109281.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-109281
Aliases
  • GHSA-cvgp-q487-j22w
Downstream
DEBIAN (1)
ECHO (1)
OESA (4)
UBUNTU (1)
Published
2026-10-12T16:04:44Z
Modified
2026-10-28T11:06:22Z
Severity
  • 4.8 (Medium) CVSS_V4 - CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N CVSS Calculator
Summary
ImageMagick 7.1.0-21 before 7.1.2-32 Heap Buffer Over-Read via -fx Option
Details

ImageMagick 7.1.0-21 before 7.1.2-32 contains a heap buffer over-read in its handling of the -fx option, where a certain -fx operation reads beyond the bounds of an allocated heap buffer in specific situations. Attackers who can get a crafted -fx expression processed can read out-of-bounds heap memory, potentially disclosing limited memory contents.

Database specific 
{
    "cna_assigner": "VulnCheck",
    "cwe_ids": [
        "CWE-125"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/109xxx/CVE-2026-109281.json"
}
References

Affected packages

Git / github.com/imagemagick/imagemagick

Affected ranges

Type
GIT
Repo
https://github.com/imagemagick/imagemagick
Events
Introduced
ddc75409693fa681446d39e2cf9929780631e848
Fixed
ad98b244c995d2e3051757fa3b7855f45b550d24
Fixed
0e82a4d0b294581186ed7b3e1dce59c858a73dba
Database specific
Show details 
{
    "extracted_events": [
        {
            "range": [
                {
                    "introduced": "7.1.0-21"
                },
                {
                    "fixed": "7.1.2-32"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StandardRange"
        },
        {
            "range": [
                {
                    "fixed": "0e82a4d0b294581186ed7b3e1dce59c858a73dba"
                }
            ],
            "source": "REFERENCES_COMMIT"
        }
    ]
}

Affected versions

7.*
7.1.0-21
7.1.0-22
7.1.0-23
7.1.0-24
7.1.0-25
7.1.0-26
7.1.0-27
7.1.0-28
7.1.0-29
7.1.0-30
7.1.0-31
7.1.0-32
7.1.0-33
7.1.0-34
7.1.0-35
7.1.0-36
7.1.0-37
7.1.0-38
7.1.0-39
7.1.0-40
7.1.0-41
7.1.0-42
7.1.0-43
7.1.0-44
7.1.0-45
7.1.0-46
7.1.0-47
7.1.0-48
7.1.0-49
7.1.0-50
7.1.0-51
7.1.0-52
7.1.0-53
7.1.0-54
7.1.0-55
7.1.0-56
7.1.0-57
7.1.0-58
7.1.0-59
7.1.0-60
7.1.0-61
7.1.0-62
7.1.1-0
7.1.1-1
7.1.1-10
7.1.1-11
7.1.1-12
7.1.1-13
7.1.1-14
7.1.1-15
7.1.1-16
7.1.1-17
7.1.1-18
7.1.1-19
7.1.1-2
7.1.1-20
7.1.1-21
7.1.1-22
7.1.1-23
7.1.1-24
7.1.1-25
7.1.1-26
7.1.1-27
7.1.1-28
7.1.1-29
7.1.1-3
7.1.1-30
7.1.1-31
7.1.1-32
7.1.1-33
7.1.1-34
7.1.1-35
7.1.1-36
7.1.1-37
7.1.1-38
7.1.1-39
7.1.1-4
7.1.1-40
7.1.1-41
7.1.1-43
7.1.1-44
7.1.1-45
7.1.1-46
7.1.1-47
7.1.1-5
7.1.1-6
7.1.1-7
7.1.1-8
7.1.1-9
7.1.2-0
7.1.2-1
7.1.2-10
7.1.2-11
7.1.2-12
7.1.2-13
7.1.2-14
7.1.2-15
7.1.2-16
7.1.2-17
7.1.2-18
7.1.2-19
7.1.2-2
7.1.2-20
7.1.2-21
7.1.2-22
7.1.2-23
7.1.2-24
7.1.2-25
7.1.2-26
7.1.2-27
7.1.2-28
7.1.2-29
7.1.2-3
7.1.2-30
7.1.2-31
7.1.2-5
7.1.2-6
7.1.2-7
7.1.2-8
7.1.2-9

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-109281.json"
vanir_signatures 
[
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "339248635718811900310702684668265490177",
                "105968466152974176257037654173002289849",
                "15480380575869614795879540275172218012",
                "266096676589963959973751065271683743705"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-109281-c9e3abd3",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/imagemagick/imagemagick/commit/0e82a4d0b294581186ed7b3e1dce59c858a73dba",
        "target": {
            "file": "MagickCore/fx.c"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "228728560721140029175781026185516454797",
            "length": 641
        },
        "id": "CVE-2026-109281-fdc980b9",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/imagemagick/imagemagick/commit/0e82a4d0b294581186ed7b3e1dce59c858a73dba",
        "target": {
            "file": "MagickCore/fx.c",
            "function": "GetIntensity"
        }
    }
]
vanir_signatures_modified 
"2026-10-28T11:06:22Z"