CVE-2026-46692

What it actually does

CVE-2026-46692 is a heap buffer overwrite in the ImageMagick distributed pixel cache server component invoked by magick -distribute-cache. An attacker with the ability to connect to that service can send crafted input that corrupts heap memory in the server process. Based on the published scoring, the expected security impact is denial of service through process crash or instability rather than confirmed code execution, with no direct confidentiality or integrity impact identified. The CVSS vector indicates local attack vector, high attack complexity, and high privileges required, so practical exploitation is constrained to attackers who already have significant access or can reach a locally exposed cache service under specific conditions.

Why it matters to the business

Successful exploitation can disrupt image-processing workloads that depend on ImageMagick distributed caching, causing failed conversions, delayed media processing, job backlogs, or service degradation. The overall risk is moderated by the high privilege and access requirements, low EPSS score, lack of known exploitation, and absence from the CISA KEV catalog, but organizations using magick -distribute-cache in production or shared processing environments should still patch to avoid avoidable availability incidents.

How an attack unfolds

An attacker first obtains sufficient local or privileged access to a system or environment where the ImageMagick distributed cache service is running, or otherwise gains the ability to connect to the magick -distribute-cache service. They then interact with the service using specially crafted cache protocol data designed to trigger incorrect heap writes in the server process. When the vulnerable code processes the malformed input, memory corruption occurs, which can crash the service or destabilize the process. In realistic scenarios, this would most likely be used to cause denial of service against image-processing pipelines rather than to steal data or modify images, as public information does not indicate confirmed remote code execution or active exploitation.

How to fix it

Upgrade ImageMagick to a patched release: 6.9.13-48 or later for the 6.x branch, or 7.1.2-23 or later for the 7.x branch. If packages are supplied by an operating system or container distribution, apply the vendor security update that backports the fix and confirm the package changelog references this issue or the fixed upstream version. If immediate patching is not possible, disable magick -distribute-cache where it is not required, restrict access to the distributed cache service to trusted local processes only, block untrusted network access with host or network firewalls, and run ImageMagick workloads with least privilege and process supervision to reduce denial-of-service impact.

How to confirm the fix worked

Confirm the installed ImageMagick version with magick -version or convert -version and verify it is at least 6.9.13-48 or 7.1.2-23, or that the OS vendor package includes the backported fix. Check running processes and service definitions for use of magick -distribute-cache and validate that the service is disabled if not needed or reachable only from trusted sources. Review firewall rules, listening sockets, and container/service manifests to ensure the distributed cache port is not exposed beyond intended boundaries. Functional validation should include restarting image-processing services and running representative image conversion jobs to confirm normal operation after upgrade.

Typical attack path

1. Identify a host running ImageMagick with the magick -distribute-cache service enabled.
2. Obtain sufficient local, privileged, or service-level access to connect to the distributed cache service.
3. Send crafted input to the cache service that reaches the vulnerable heap buffer overwrite condition.
4. Trigger memory corruption in the ImageMagick server process.
5. Cause the service to crash, restart repeatedly, or become unstable, disrupting image-processing operations.

How to detect it

To assess possible prior exploitation, review process supervision logs, system journals, application logs, and container logs for crashes or abnormal restarts of ImageMagick commands or services using magick -distribute-cache. Look for segmentation faults, heap corruption messages, malloc/free errors, core dumps, or repeated restarts correlated with inbound connections to the distributed cache service. Network telemetry may show unexpected clients connecting to the cache service, especially from users or workloads that do not normally perform distributed image processing. If core dumps are available, preserve and analyze them for crashes in ImageMagick distributed cache handling code paths. There are no widely published exploit-specific payload strings or actor-specific indicators for this issue, so detection should focus on service exposure, anomalous connections, and memory-corruption crash artifacts.

• magick -distribute-cache
• Segmentation fault
• heap buffer overflow
• heap-buffer-overflow
• malloc(): corrupted top size
• malloc(): memory corruption
• free(): invalid pointer
• double free or corruption
• corrupted double-linked list
• core dumped
• imagemagick
• magick

What your security team should do

• Inventory systems, containers, and build images that include ImageMagick and identify any use of magick -distribute-cache.
• Prioritize patching systems where the distributed cache service is enabled or reachable by multiple users, shared workloads, or untrusted processing jobs.
• Upgrade to ImageMagick 6.9.13-48 or later, 7.1.2-23 or later, or a vendor package containing the backported fix.
• Disable magick -distribute-cache wherever distributed pixel caching is not operationally required.
• Restrict service reachability using local-only binding, host firewalls, network ACLs, and least-privilege runtime accounts.
• Monitor ImageMagick service crashes and repeated restarts as potential exploitation or reliability indicators.
• Because this is not currently in KEV, has low EPSS, and has no known public exploit maturity, handle through normal vulnerability management unless the service is exposed or critical to production availability.