EUVD-2026-97702
GHSA-qr3h-jrh3-5m34
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessGain local/low-priv access to ImageMagick
-
DeliverySupply crafted FX expression or image
-
ExploitForce FX runtime entry init failure
-
ExecutionInvalid free on wrong fxrts index
-
ImpactMemory corruption and application crash (DoS)
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A10:2025 - Mishandling of Exceptional Conditions
ASVS 5.0
V16 - Security Logging and Error Handling Null pointer safety, defensive checks
MITRE ATT&CK
1 technique across 1 tactic: Impact The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the ability to drive ImageMagick's fx operation (the -fx operator / FxEvaluateChannelExpression path in MagickCore/fx.c) with input that causes initialization of an FX runtime entry to FAIL; only on that error-cleanup path does the code free the wrong runtime entry (fxrts[t] instead of fxrts[t2]). Limiting factors: the attack is local (AV:L) and needs at least low privileges (PR:L), and the specific failure condition must be met (AT:P), so it does not trigger against normal FX usage or default processing of benign images; impact is confined to availability (crash/DoS) with no confidentiality or integrity loss. |
| Impact | All signals point to a genuinely LOW-priority issue rather than a high-CVSS scare. The vendor-supplied CVSS 4.0 vector (AV:L/AC:L/AT:P/PR:L/UI:N) scores only 2.0 and limits impact to availability (VA:L) with no confidentiality or integrity effect - consistent with the description, which describes an invalid free leading to memory corruption and application crashes (a denial-of-service outcome), not code execution. The attacker needs local access (AV:L), at least low privileges (PR:L), and must satisfy a specific attack requirement (AT:P) - namely forcing the FX runtime entry initialization to fail - so exploitation is conditional, not trivial. There is no EPSS score, no CISA KEV listing, and no public exploit provided in the input, so there is no evidence of active or widespread exploitation; this is a reliability/robustness bug. One signal to reconcile: the CWE is CWE-476 (NULL pointer dereference) and tags include 'Null Pointer Dereference' and 'Buffer Overflow', but the description and the commit diff show the root cause is an invalid free of the wrong array index (DestroyFxRt on fxrts[t] instead of fxrts[t2]) during cleanup - closer to an invalid/double-free (CWE-415/CWE-763) than a NULL deref or overflow; the memory-corruption mechanism should be verified against the vendor advisory, though it does not change the low-severity DoS conclusion. |
| Exploit ScenarioDerived | A local or low-privileged user submits a crafted image or FX expression (for example via ImageMagick's -fx operator) engineered so that initialization of an FX runtime entry fails. During the error-cleanup path ImageMagick frees the wrong runtime entry, corrupting memory and crashing the process. No public exploit code was identified in the provided data, and the realistic outcome is denial of service of the ImageMagick-dependent application rather than code execution. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 12, 2026
An invalid memory free in ImageMagick's fx expression evaluator (MagickCore/fx.c) lets a local attacker with low privileges crash the process by forcing initialization of an FX runtime entry to fail, producing a denial-of-service condition in applications that pass attacker-controlled input to the -fx operator. Only the error-cleanup path is defective - the code frees fxrts[t] instead of fxrts[t2] - so the bug does not trigger during normal FX usage or default processing of benign images, and there is no confidentiality or integrity impact. No public exploit code has been identified at time of analysis and the issue is not referenced by CISA KEV; the independent assessment rates it low (CVSS 3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L), and vendor fixes are available.
RemediationAI
The vendor fix is upstream commit 8caa6a0c62a3ac1f81b19a2ee929fbfe46ee0323 (MagickCore/fx.c); users should upgrade to ImageMagick 7.1.2-32 or later per the advisory at https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-pv8x-gq6w-gp4r, and distributions should backport that one-line DestroyFxRt index correction if they cannot rebase. If an upgrade is not immediately possible, block or sanitize attacker-controlled input to the -fx operator rather than attempting to filter expression syntax, since the fault occurs in an initialization-failure cleanup path; wrappers and services should disable FX expression evaluation for untrusted users and reject requests containing the fx operator entirely, accepting the functional loss of FX-based image manipulation as the trade-off. Because exploitation is local and availability-only, additional depth can come from running ImageMagick under resource limits and process supervisors that automatically restart on abnormal termination - this reduces crash impact but does not remove the invalid free and should not be treated as a substitute for the patch.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The defect lives in MagickCore/fx.c, in ImageMagick's FX (fx) expression engine, which parses user-supplied expressions such as '-fx "..."' and builds an array of FX runtime entries (FxRuntime objects stored in the FxInfo structure's fxrts array) through AcquireFxInfoPrivate. When initialization of one of those runtime entries fails, the error-cleanup loop is supposed to release each successfully initialized entry, but the upsteam commit 8caa6a0c62a3ac1f81b19a2ee929fbfe46ee0323 changes the target of the cleanup call from DestroyFxRt(&pfx->fxrts[t]) to DestroyFxRt(&pfx->fxrts[t2]), i.e. the wrong index was being freed. The result is an invalid free / memory corruption that can terminate the process. The record is classified under CWE-476 (NULL pointer dereference), which matches the family of memory-safety faults triggered by inconsistent internal state during FX runtime setup and cleanup; the practical manifestation here is an invalid free on an error path rather than routine exploitation of the FX grammar. Because the fault requires the specific failure condition (AT:P in the CVSS 4.0 vector, AC:H in the assessed 3.1 vector) plus local access (AV:L) and low privileges (PR:L), the affected surface is narrower than a general-purpose ImageMagick parser bug.
Know when Imagemagick gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
Local FX processing with low privileges (AV:L/PR:L); the required FX-init-failure condition makes it AC:H; availability-only crash yields C:N/I:N/A:L.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
DescriptionCVE.org
ImageMagick 7.1.0-20 before 7.1.2-32 contains an invalid memory free vulnerability in the fx operation that occurs when initialization of an FX runtime entry fails. Attackers can trigger the failed FX runtime initialization to cause an invalid free, resulting in memory corruption and application crashes.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
A null pointer dereference occurs when a program attempts to access memory through a pointer that has been set to NULL (address 0x0).
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
More in Imagemagick
View allThe (1) EPHEMERAL, (2) HTTPS, (3) MVG, (4) MSL, (5) TEXT, (6) SHOW, (7) WIN, and (8) PLT coders in ImageMagick before 6.
The (1) HTTP and (2) FTP coders in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allow remote attackers to conduct
The EPHEMERAL coder in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allows remote attackers to delete arbitrary fi
ReadGIFImage in coders/gif.c in ImageMagick 7.0.6-1 and GraphicsMagick 1.3.26 leaves the palette uninitialized when proc
Integer overflow in MagickCore/profile.c in ImageMagick before 7.0.2-1 allows remote attackers to cause a denial of serv
The LABEL coder in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allows remote attackers to read arbitrary files vi
The OpenBlob function in blob.c in GraphicsMagick before 1.3.24 and ImageMagick allows remote attackers to execute arbit
The DCM reader in ImageMagick before 6.9.4-5 and 7.x before 7.0.1-7 allows remote attackers to have unspecified impact b
The ReadDCMImage function in DCM reader in ImageMagick before 6.9.4-5 and 7.x before 7.0.1-7 allows remote attackers to
The DCM reader in ImageMagick before 6.9.4-5 and 7.x before 7.0.1-7 allows remote attackers to have unspecified impact b
ImageMagick 7.0.6-5 has a memory leak vulnerability in ReadWEBPImage in coders/webp.c because memory is not freed in cer
Heap buffer overflow in ImageMagick's XBM image decoder (ReadXBMImage) lets remote attackers write attacker-controlled d
Exploit-DB