ImageMagick CVE-2026-109280

Exploitation requires an attacker who can supply crafted '-fx' expressions to ImageMagick (the MagickCore fx.c expression evaluator) AND can induce a memory-allocation failure - i.e., the process must be under genuine memory pressure so that the RPN-table reallocation in ExtendRPN fails, which is the AT:P attack requirement in the vector. This is a local, low-privileged path (AV:L/PR:L), so it applies chiefly to services or multi-tenant workers that expose user-controlled -fx input rather than to remote unauthenticated attackers. Limiting factors: the allocation-failure precondition is not attacker-deterministic under normal conditions, only low-severity availability impact results, and local access plus existing privileges are needed.

This is a genuinely low-priority issue, and the signals are consistent rather than conflicting. The vendor-supplied CVSS 4.0 vector (AV:L/AC:L/AT:P/PR:L/UI:N, impact VA:L only) scores just 2.0, reflecting that exploitation requires local access, prior low-level privileges, and a specific attack precondition (AT:P) - namely that a heap allocation must actually fail under memory pressure. The only confirmed impact is a degraded-availability outcome (crash); confidentiality and integrity are rated N by the vendor. There is no CISA KEV listing and no public exploit identified at time of analysis, so there is no evidence of real-world exploitation. One internal inconsistency worth noting: the description characterizes the flaw as a use-after-free with potential 'memory corruption,' which could imply integrity impact, yet both the assigned CWE-476 (NULL pointer dereference) and the vendor VC:N/VI:N scoring treat it as a crash-class defect - the patch (adding a NULL check in AddElement and preserving the old RPN table on realloc failure in ExtendRPN) supports the crash/NULL-deref interpretation over weaponizable corruption. Net: a real bug fixed by the vendor, but not an urgent patch priority outside hardened multi-tenant image-processing contexts.

A local or low-privileged user of a service that passes user-controlled '-fx' expressions to ImageMagick (e.g., a constrained image-processing worker) submits a crafted expression while the process is under memory pressure, causing an RPN-table reallocation to fail and the code to access freed/NULL memory. The result is a crash or potential memory corruption, degrading availability of the processing service. No public proof-of-concept exploit has been identified at time of analysis.