{"id":"CVE-2026-109258","url":"https://www.cyber-defence.io/tools/cve/CVE-2026-109258","generatedAt":"2026-10-28T01:02:43.849Z","title":"ImageMagick 7.1.0-20 before 7.1.2-32 contains an invalid memory free vulnerability in the fx operation that occurs when initialization of an FX runtime entry fails.","description":"ImageMagick 7.1.0-20 before 7.1.2-32 contains an invalid memory free vulnerability in the fx operation that occurs when initialization of an FX runtime entry fails. Attackers can trigger the failed FX runtime initialization to cause an invalid free, resulting in memory corruption and application crashes.","published":"2026-10-12T17:17:17.000Z","lastModified":"2026-10-13T20:39:49.000Z","status":"Awaiting Analysis","sourceIdentifier":"disclosure@vulncheck.com","cvss":{"version":"4.0","score":2,"severity":"LOW","vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M"},"cwe":["CWE-476"],"affected":[],"epss":{"score":0.00112,"percentile":0.01359,"date":"2026-10-26","history":[{"date":"2026-10-13","score":0.00112,"percentile":0.01294}]},"kev":{"listed":false},"exploits":{"count":0,"verified":false,"firstPublished":null,"source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[]},"verdict":{"level":"low","text":"Lower severity and a low EPSS score (0.11%). Track it; it rarely justifies an emergency change on its own."},"changes":[{"kind":"new","label":"New CVE","at":"2026-10-12T17:17:17.000Z","detail":{"score":"2.0","severity":"LOW","publishedAt":"2026-10-12T17:17:17.427Z"},"summary":"New CVE, low severity (CVSS 2.0)."}],"references":[{"url":"https://github.com/ImageMagick/ImageMagick/commit/8caa6a0c62a3ac1f81b19a2ee929fbfe46ee0323","source":"disclosure@vulncheck.com"},{"url":"https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-pv8x-gq6w-gp4r","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/imagemagick-7.1.0-20-before-7.1.2-32-invalid-memory-free-in-fx-operation","source":"disclosure@vulncheck.com"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-109258","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}