CVE-2026-46692: ImageMagick Distributed Cache Heap Buffer Overwrite Denial of Service

Technical summary

The vulnerability resides in ImageMagick's magick -distribute-cache service, a local inter-process communication component. A heap buffer overwrite occurs when the service processes specially crafted input from a connected client. The flaw is classified as CWE-122 (Heap-based Buffer Overflow). The CVSS 3.1 score of 4.1 (MEDIUM) reflects the requirement for local access (AV:L), high complexity to exploit (AC:H), high privilege level needed (PR:H), and impact limited to availability (A:H). No information disclosure or integrity compromise is possible through this vector.

Business impact

Organizations running ImageMagick's distributed cache service in multi-user environments face service interruptions if an authenticated local user or privileged attacker can reach the cache daemon. For production image processing pipelines relying on the cache service for performance, exploitation would degrade throughput and require service restart. The moderate CVSS score and operational friction (privilege and network prerequisites) mean this is not a critical remote exploit vector, but availability impact warrants timely patching in systems where uptime is essential.

Affected systems

ImageMagick versions 6.9.13-47 and earlier (6.x branch) and 7.1.2-22 and earlier (7.x branch) are vulnerable when the distributed cache service is enabled and accessible. Users running only the command-line tools without cache services, or those running patched versions 6.9.13-48 or 7.1.2-23 and later, are unaffected. Verify your installed version via `convert -version` and check whether the cache service is configured and running.

Exploitability

Exploitation requires: (1) local network or system access to reach the magick -distribute-cache listening socket, (2) ability to connect as an authenticated user or process, and (3) knowledge of the cache protocol to craft a malformed message triggering the buffer overwrite. The high complexity (AC:H) and privilege requirements (PR:H) limit opportunistic exploitation. There is no evidence of public exploit code or active in-the-wild attacks. This is not a remote code execution vector and does not enable privilege escalation.

Remediation

Upgrade ImageMagick to version 6.9.13-48 or later (6.x users) or 7.1.2-23 or later (7.x users). The patch directly addresses the heap buffer overflow in the cache service. Organizations should apply updates during standard maintenance windows and verify the service restarts cleanly. For systems where patching is delayed, restrict local access to the cache daemon socket via filesystem permissions or disable the distributed cache service if not essential.

Patch guidance

Download and install ImageMagick 6.9.13-48 (legacy) or 7.1.2-23 (current) from the official ImageMagick repository or your distribution's package manager. Verify the patch was applied by running `identify -version` or `convert -version` and confirming the version number matches or exceeds the patched release. Test image processing workflows post-update to ensure cache service functionality. Verify against the vendor advisory at imagemagick.org for distribution-specific instructions.

Detection guidance

Monitor for unusual termination or repeated restarts of the magick -distribute-cache daemon process, which may indicate exploitation attempts causing crashes. Check process logs for segmentation faults or core dumps involving the cache service. If available, enable cache service debug logging to detect malformed protocol messages. Network-level detection is difficult without traffic analysis, but unusual local connections to the cache socket may warrant investigation. Organizations should prioritize version scanning to identify vulnerable instances before exploitation occurs.

Why prioritize this

Although CVSS scores this MEDIUM (4.1), the practical risk is lower due to local-only attack surface and privilege requirements. Prioritize patching in multi-user systems or shared hosting environments where local users have network access to the cache daemon. Single-user or air-gapped systems running ImageMagick without the cache service enabled can defer updates, but should still plan for patching within 90 days. This is not an emergency-level vulnerability requiring immediate out-of-band action.

Risk score, explained

The CVSS 3.1 score of 4.1 reflects: AV:L (attack requires local presence, not remote), AC:H (high complexity due to buffer overwrite exploitation difficulty), PR:H (high privileges or authenticated access needed), and isolated impact on availability (A:H, but C:N and I:N). The score appropriately penalizes a vulnerability that requires significant preconditions but does cause service crashes. Organizations with strong local access controls and no exposed cache daemon may tolerate this risk longer; those with permissive local environments should prioritize patching sooner.

Frequently asked questions