CVE-2026-46693: ImageMagick Distributed Cache Race Condition & File Descriptor Hijacking

Technical summary

CVE-2026-46693 is a race condition (CWE-362) affecting ImageMagick's distributed cache daemon. The vulnerability exists in versions prior to 6.9.13-48 (legacy branch) and 7.1.2-23 (current branch). When the magick -distribute-cache service is running, an attacker can establish a connection to the cache listener and, by winning a race condition, redirect or hijack an open file descriptor in the server process. This allows reading of file contents that the server process has open, bypassing normal access controls. The attack is local in nature (AV:L) and requires high privilege context on the victim system (PR:H), with a difficult exploitation condition (AC:H) due to the timing-sensitive race window.

Business impact

Organizations deploying ImageMagick with the distributed cache service enabled—commonly in multi-instance image processing pipelines, content management systems, or automated image conversion workflows—face confidentiality risk. A malicious or compromised local user could read sensitive images, documents, or data being processed by the ImageMagick service, leading to data disclosure. The impact is limited to confidentiality; integrity and availability are not affected. Risk is highest in shared or multi-tenant environments where untrusted users have system access.

Affected systems

ImageMagick versions 6.9.13-47 and earlier (6.x line) and 7.1.2-22 and earlier (7.x line) are vulnerable. The distributed cache service must be explicitly enabled and running for the vulnerability to be exploitable. Systems using ImageMagick for image processing without the -distribute-cache flag or without local attackers present face no direct risk from this issue.

Exploitability

Exploitation requires local system access (AV:L) and is not a remote code execution path. The attacker must be able to connect to the magick -distribute-cache listener socket, typically a local service. The race condition is not trivial to trigger (AC:H), demanding precise timing and potentially multiple attempts. High privilege context (PR:H) is needed, meaning the attacker must already have a foothold on the system with non-root but elevated permissions. Overall, this is a privilege escalation and data disclosure vector rather than an easy-to-trigger remote attack.

Remediation

Upgrade ImageMagick to version 6.9.13-48 or later for the legacy branch, or 7.1.2-23 or later for the current branch. Verify the version after patching. If immediate patching is not possible, disable the distributed cache service (remove -distribute-cache from startup scripts) until patches are applied. Restrict local system access via strong authentication and user isolation policies. Monitor connections to the cache service socket for suspicious activity.

Patch guidance

Apply the following patches: ImageMagick 6.9.13-48 or later, or ImageMagick 7.1.2-23 or later. Verify patch installation by running `magick -version` and confirming the version string matches or exceeds the patched versions. After patching, restart any running magick -distribute-cache processes. Consult the official ImageMagick release notes at imagemagick.org for any additional deployment considerations or breaking changes between your current and target version.

Detection guidance

Monitor system logs for authentication attempts and privilege escalation events targeting users running the ImageMagick cache service. Check for multiple failed connection attempts to local cache service sockets (typically /tmp/.magick* or similar paths). Use process monitoring to detect unexpected child processes spawned by the magick daemon. Examine system call traces for file descriptor manipulation or unusual open/dup calls in the cache service process. In high-risk environments, use security modules (AppArmor, SELinux) to restrict file descriptor access and audit capability-based file operations.

Why prioritize this

Despite the medium CVSS score, this vulnerability should be prioritized in environments where (1) ImageMagick distributed cache is in active use for production image pipelines, (2) untrusted users have shell access to the same host, or (3) sensitive images or data are processed regularly. The confidentiality impact, combined with the local privilege escalation angle, makes it relevant to shared hosting, SaaS platforms, and content-heavy organizations. However, it is not immediately critical for systems where cache is disabled or in isolated, single-user environments.

Risk score, explained

The CVSS 3.1 score of 4.1 (Medium) reflects the combination of factors: local attack vector reduces severity compared to remote attacks; the high complexity (AC:H) of the race condition significantly lowers exploitability; high privilege requirement (PR:H) narrows the attacker pool; and impact is limited to confidentiality (C:H, I:N, A:N), ruling out system compromise or data integrity loss. The score is appropriate for a data disclosure risk that requires local presence, elevated context, and precise timing.

Frequently asked questions