Vulnerability Details CVE-2026-109271
ImageMagick 7.1.2-30 before 7.1.2-32 contains a use after free vulnerability in the WBINFO decoder that occurs when a memory allocation fails during image decoding. Attackers can supply a crafted image that, when decoded under memory allocation failure conditions, causes freed memory to be reused, crashing the application.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.004
EPSS Ranking 30.5%
CVSS Severity
CVSS v3 Score 3.7
References
- https://github.com/ImageMagick/ImageMagick/commit/2ed1b96b9bc71434f0c4e82e3c63fec029c684c6
- https://github.com/ImageMagick/ImageMagick/commit/48c49d0cc2b72970b762e0d3263f6c35ab35a7b4
- https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-vxwm-jfjc-3r4x
- https://www.vulncheck.com/advisories/imagemagick-7.1.2-30-before-7.1.2-32-use-after-free-in-wbinfo-decoder
Products affected by CVE-2026-109271
-
cpe:2.3:a:imagemagick:imagemagick:7.1.2-30
-
cpe:2.3:a:imagemagick:imagemagick:7.1.2-31