ImageMagick CVE-2026-109281

Exploitation requires that the attacker can get a crafted -fx expression processed by ImageMagick - specifically an fx operation that reaches the GetIntensity code path with a controllable or out-of-range image index. The primary limiting factors are: the vector is local (AV:L) and requires low privileges (PR:L per the provided CVSS 4.0 vector), i.e. the ability to invoke ImageMagick with attacker-influenced -fx input rather than purely remote unauthenticated access; impact is confined to a limited out-of-bounds heap read (minor memory disclosure) and possible crash, with no code execution or integrity impact. Risk rises substantially only in deployments where a service passes untrusted user input into -fx expressions; against default command-line use where -fx is operator-controlled, the practical attack surface is small. Affected versions are ImageMagick 7.1.0-21 through before 7.1.2-32.

This is a genuinely low-to-moderate priority issue, not a high-severity emergency. The vendor-supplied CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:L) yields 4.8 (Medium) and is internally consistent with the description: exploitation requires local access and at least low privileges (PR:L) to get a crafted -fx expression processed, and the impact is bounded - limited confidentiality (VC:L, small out-of-bounds heap read) and limited availability (VA:L, likely a crash), with no integrity impact. No EPSS score was provided, the CVE is not on CISA KEV, and no public POC is referenced, so there is no signal of active or imminent widespread exploitation - all three exploitation-pressure signals are either absent or negative. The strongest confirmed artifact is the upstream fix commit (a one-line index correction from pfx->ImgNum to ImgNum in GetIntensity in MagickCore/fx.c), which corroborates the CWE-125 out-of-bounds read root cause. One nuance to verify: ImageMagick is frequently used as a server-side processing engine where -fx expressions could in some deployments be influenced by untrusted input, which would effectively raise the attack vector toward network/remote - the AV:L rating assumes the -fx expression is operator-controlled, so deployments that expose -fx to user input should treat this as higher risk than the base score implies.

An attacker who can supply or influence a -fx expression evaluated by a vulnerable ImageMagick (7.1.0-21 up to 7.1.2-32) - for example a local user running a conversion, or a web service that passes untrusted parameters into an fx operation - crafts an expression that triggers the faulty image-index access in GetIntensity. The out-of-bounds heap read returns limited adjacent memory contents, potentially leaking small fragments of process memory, or crashes the process. No public exploit code is identified at time of analysis, so exploitation currently requires independent development against the known fix commit.