Vulnerability DatabaseCVE-2026-109271
Mend.io Vulnerability Database
The largest open source vulnerability database
What is a Vulnerability ID?
New vulnerability? Tell us about it!
CVE-2026-109271
Published:October 12, 2026
Updated:October 13, 2026
ImageMagick 7.1.2-30 before 7.1.2-32 contains a use after free vulnerability in the WBINFO decoder that occurs when a memory allocation fails during image decoding. Attackers can supply a crafted image that, when decoded under memory allocation failure conditions, causes freed memory to be reused, crashing the application.
Affected Packages
https://github.com/ImageMagick/ImageMagick.git (GITHUB):
Affected version(s) >=7.1.2-30 <7.1.2-32
Fix Suggestion:
Update to version 7.1.2-32
Related Resources (6)
https://github.com/ImageMagick/ImageMagick/commit/48c49d0cc2b72970b762e0d3263f6c35ab35a7b4
https://www.vulncheck.com/advisories/imagemagick-7.1.2-30-before-7.1.2-32-use-after-free-in-wbinfo-decoder
https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-vxwm-jfjc-3r4x
https://github.com/ImageMagick/ImageMagick/commit/2ed1b96b9bc71434f0c4e82e3c63fec029c684c6
https://nvd.nist.gov/vuln/detail/CVE-2026-109271
https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/109xxx/CVE-2026-109271.json
Do you need more information?
Contact Us
CVSS v4
Base Score:
6.3
Attack Vector
NETWORK
Attack Complexity
LOW
Attack Requirements
PRESENT
Privileges Required
NONE
User Interaction
NONE
Vulnerable System Confidentiality
NONE
Vulnerable System Integrity
NONE
Vulnerable System Availability
LOW
Subsequent System Confidentiality
NONE
Subsequent System Integrity
NONE
Subsequent System Availability
NONE
CVSS v3
Base Score:
3.7
Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
NONE
Integrity
NONE
Availability
LOW
Weakness Type (CWE)
Double Free
CWE-415
EPSS
Base Score:
0.37