CVE-2026-47166: ImageMagick Distributed Cache Heap Over-Read (CVSS 5.7)

Technical summary

CVE-2026-47166 is a heap buffer over-read vulnerability in ImageMagick's distributed cache server component. The flaw exists in how the magick -distribute-cache service processes incoming connections and image data. An authenticated local attacker can craft a malicious request that causes the server process to read memory beyond the bounds of an allocated heap buffer. This is classified as a CWE-125 (Out-of-bounds Read) combined with authentication weaknesses (CWE-287), resulting in potential information disclosure or service disruption. The CVSS 3.1 score of 5.7 (MEDIUM) reflects the requirement for local access and high privilege level, though the potential for confidentiality breach and availability impact justifies attention.

Business impact

Organizations running ImageMagick with the distributed cache feature enabled face localized risk. The vulnerability requires an attacker to already have local system access and elevated privileges, limiting exposure in typical cloud or SaaS deployments. However, in environments where image processing is delegated to shared systems (internal design services, batch processing clusters), a malicious insider or compromised local account could leak sensitive image data or trigger service interruptions. The primary business risk is data confidentiality: unintended exposure of images or embedded metadata during heap over-read operations.

Affected systems

ImageMagick versions 6.9.13-47 and earlier (6.x branch) and versions 7.1.2-22 and earlier (7.x branch) are vulnerable when the -distribute-cache option is enabled. The distributed cache service is an optional feature used for performance optimization in multi-process image workflows. Systems using ImageMagick in standalone mode (without -distribute-cache) are not affected. End users should verify their deployment: check running ImageMagick processes for the -distribute-cache flag and review version numbers against the patched releases.

Exploitability

Exploitation requires local system access and the ability to connect to a listening magick -distribute-cache service. The CVSS vector (AV:L/AC:H/PR:H) indicates local-only attack surface with high complexity and high privilege requirements. This is not a remote code execution vulnerability and cannot be exploited over the network from untrusted sources. Practical risk exists primarily in multi-tenant or shared computing environments where different users or processes can interact with a common ImageMagick cache daemon. The vulnerability is not listed on CISA's Known Exploited Vulnerabilities catalog, indicating no evidence of active exploitation in the wild as of the publication date.

Remediation

Upgrade ImageMagick to version 6.9.13-48 or later (6.x series) or 7.1.2-23 or later (7.x series). Organizations unable to patch immediately should consider disabling the -distribute-cache feature if not essential to operations, or restrict local system access to only trusted users. Verify after patching that the correct version is running and that no stale processes are still using older binaries.

Patch guidance

Update ImageMagick through your package manager or build from source. For apt/yum-based distributions, verify the available version in your configured repositories matches or exceeds 6.9.13-48 (6.x) or 7.1.2-23 (7.x). Users on legacy 6.x branches should plan migration to the 7.x line for continued support. After upgrade, restart any applications or services that embed or invoke ImageMagick, and confirm via `convert -version` or `magick -version` that the new version is in effect. Test image processing workflows to ensure compatibility.

Detection guidance

Monitor for unexpected connections to ImageMagick cache ports (typically port 6666 by default). Check process listings for running magick -distribute-cache daemons and note their version. If you suspect exploitation, examine system logs for segmentation faults or memory corruption errors in ImageMagick processes. Memory analysis tools (valgrind, AddressSanitizer) can detect heap over-read patterns if you can reproduce a suspected attack. Network segmentation to restrict cache daemon access to trusted processes is a practical interim control.

Why prioritize this

This is a MEDIUM-severity vulnerability suitable for standard patching cycles rather than emergency response. The local-only attack surface and high privilege requirements significantly reduce real-world exploitability. However, organizations operating image processing clusters or multi-tenant design platforms should prioritize this patch within 30–60 days, as the confidentiality impact (heap memory disclosure) could expose sensitive user images or metadata. No active exploitation has been reported.

Risk score, explained

The CVSS 3.1 score of 5.7 reflects a balance of factors: confidentiality impact (HIGH) and availability impact (HIGH) are offset by the stringent attack requirements (local access, high privileges, high complexity). The score appropriately captures that while the technical impact of a heap over-read is serious, the realistic attack surface in most organizations is limited. Organizations with strict local access controls will see lower practical risk; those with shared or less-controlled systems should weight this higher in their prioritization.

Frequently asked questions