CVE-2026-47165: ImageMagick Distributed Pixel Cache Authentication Bypass

Technical summary

The distributed pixel cache in ImageMagick versions prior to 6.9.13-48 (legacy branch) and 7.1.2-23 (current branch) lacked challenge-response authentication mechanisms. This design flaw is categorized under CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor). The vulnerability requires local access and high privilege context to exploit, limiting its scope but creating risk in multi-tenant or shared-resource scenarios. The patch introduces authentication controls to gate access to cached pixel data, preventing unauthorized reading of image content across process boundaries.

Business impact

Organizations using ImageMagick in image processing pipelines—particularly those handling sensitive visual content (medical imaging, confidential documents, design assets)—face confidentiality risk. Exploitation requires local system access and elevated privileges, so the practical threat is highest in shared hosting, containerized environments with weak isolation, or organizations with multiple internal applications accessing a centralized ImageMagick service. Reputational and compliance impact depends on the sensitivity of images being processed; healthcare, legal, and financial sectors should prioritize patching if patient records, case files, or proprietary designs are at risk.

Affected systems

ImageMagick versions 6.9.x prior to 6.9.13-48 and 7.x prior to 7.1.2-23 are affected. Both the legacy 6.9 branch and the current 7.x mainline have published patches. Any deployment using the distributed pixel cache feature (commonly enabled in multi-process or networked image processing setups) is in scope. The flaw does not affect static image conversion operations that do not leverage distributed caching.

Exploitability

Exploitation requires local system access (AV:L) and high-privilege context (PR:H), creating significant barriers for external attackers. An insider or a compromised high-privilege service running locally could read cached pixel data. The attack is not trivially obvious (AC:H suggests moderately complex conditions), so opportunistic exploitation is unlikely. However, in containerized or cloud environments where workload isolation is imperfect, or in organizations with permissive sudo policies, the risk increases. No public exploit code is known to exist.

Remediation

Upgrade ImageMagick to version 6.9.13-48 or later (legacy users) or 7.1.2-23 or later (current users). Both patches introduce authentication to the distributed pixel cache. Administrators should test patches in staging first, as image processing pipeline changes may require validation. For organizations unable to patch immediately, disable distributed pixel cache if not required for workload performance, and enforce strict local access controls and privilege separation around ImageMagick processes.

Patch guidance

Check your current ImageMagick version using 'convert -version'. Users on the 6.9 branch should target 6.9.13-48 or any later 6.9.x release; users on 7.x should update to 7.1.2-23 or later. Patches are available from the official ImageMagick repository and most Linux distributions' package managers. Plan patching within your normal maintenance windows; the authentication model change should be backward-compatible for typical usage. Verify patch installation post-deployment by confirming the version string reflects the patched release.

Detection guidance

Monitor ImageMagick process logs for distributed pixel cache activity, particularly unexpected access from unprivileged processes or non-service accounts. In environments with audit logging enabled, flag local connections to the pixel cache socket that lack expected authentication handshakes (this behavior should disappear post-patch). Inspect configurations to identify which systems rely on distributed caching; these are priority targets for monitoring and patching. No network-level detection is applicable since the vulnerability is strictly local.

Why prioritize this

Although the CVSS score is moderate (4.1), the local-only attack vector and high-privilege requirement lower immediate urgency for most organizations. However, prioritize this patch if: (1) you operate shared or multi-tenant ImageMagick services, (2) you process highly sensitive visual data, (3) your environment has weak privilege boundaries or container isolation, or (4) you operate in healthcare or legal sectors subject to data protection regulations. Organizations with strong local access controls and single-tenant deployments can defer this to routine maintenance cycles.

Risk score, explained

The CVSS 3.1 score of 4.1 (MEDIUM) reflects the confidentiality impact (C:H) balanced against restrictive attack conditions: local-only access (AV:L), high privileges required (PR:H), and moderately complex exploitation (AC:H). No integrity or availability impact exists. The 'MEDIUM' severity reflects that while real data exposure is possible, the attack surface is narrow. Organizations should not interpret 'MEDIUM' as 'low-risk'; the context of your environment and data sensitivity should drive your response, potentially elevating urgency beyond the base score.

Frequently asked questions