CVE-2026-46693

What it actually does

This is a race condition in ImageMagick's distributed pixel cache service, invoked as `magick -distribute-cache`. An attacker with sufficient local privileges or access to connect to that service can attempt to win a timing race that causes the server process to use or expose the wrong file descriptor. The practical security effect is potential disclosure of sensitive data accessible through the server process's open file descriptors. The issue is high-complexity and requires elevated privileges or meaningful access to the service, but successful exploitation can compromise confidentiality.

Why it matters to the business

Organizations using ImageMagick with the distributed cache service enabled could face unauthorized exposure of files or data handled by the image-processing service. The CVSS score is moderate and EPSS is currently very low, with no known CISA KEV listing or public exploit maturity indicated, so this is not an Internet-scale emergency; however, systems processing sensitive images, documents, temporary files, or shared workloads should prioritize remediation because a successful attack could expose confidential business data.

How an attack unfolds

An attacker first needs access to a host or network context where they can connect to an ImageMagick `magick -distribute-cache` service. They then repeatedly interact with the distributed cache service while attempting to trigger a narrow timing window in the server process. If the race condition is won, the attacker can hijack or influence a file descriptor used by the server process. Because file descriptors can reference open files, sockets, pipes, or temporary resources, this may let the attacker read sensitive content that the service process can access. Exploitation is expected to be unreliable because the attack complexity is high and depends on precise timing and service configuration.

How to fix it

Upgrade ImageMagick to a patched release: ImageMagick 6.9.13-48 or later for the 6.x branch, or ImageMagick 7.1.2-23 or later for the 7.x branch. If immediate upgrade is not possible, disable the distributed cache service where it is not required, restrict access to `magick -distribute-cache` to only trusted local users or trusted network segments, run ImageMagick workloads under least-privilege service accounts, and isolate image-processing services from sensitive files and credentials. Review package-manager versions carefully because downstream Linux distributions may backport the fix without using the upstream version number.

How to confirm the fix worked

Confirm the installed ImageMagick version with `magick -version`, `convert -version`, or the operating system package manager, and verify it is at or above 6.9.13-48 or 7.1.2-23, or that the vendor package includes the backported fix. Check running processes and service definitions for `magick -distribute-cache`; if it is not required, confirm it is disabled and no longer listening. Validate exposure by reviewing firewall rules, service bindings, and local access controls to ensure untrusted users or networks cannot connect to the distributed cache service. After remediation, restart ImageMagick-related services and repeat version and process checks.

Typical attack path

1. Identify a host running ImageMagick with the distributed cache service enabled.
2. Obtain local privileged access or otherwise gain the ability to connect to the `magick -distribute-cache` service.
3. Enumerate the service behavior and timing characteristics by making repeated cache-service requests.
4. Trigger concurrent or carefully timed interactions intended to hit the race condition.
5. Cause the server process to confuse, reuse, or expose a file descriptor controlled or observable by the attacker.
6. Read data exposed through the hijacked file descriptor and use it to collect sensitive information.

How to detect it

Look for evidence that the distributed cache service was enabled and accessed by unexpected users or sources. Useful log sources include process execution telemetry, Linux audit logs, systemd journal entries, shell history, endpoint detection logs, network connection logs, firewall logs, and container runtime logs. Search for execution of `magick` with the `-distribute-cache` argument, unexpected listeners associated with ImageMagick, repeated rapid connections to the cache service, or service crashes and restarts around suspicious access times. Because exploitation depends on a race condition and file-descriptor behavior, direct proof may be limited; prioritize correlation between cache-service access, abnormal ImageMagick process behavior, and subsequent access to sensitive files or temporary directories by the ImageMagick service account. Also review whether untrusted users had local shell access or network reachability to the service before patching.

• magick -distribute-cache
• -distribute-cache
• process.name:magick AND process.command_line:*distribute-cache*
• process.name:convert AND process.command_line:*distribute-cache*
• ImageMagick
• MagickCore
• MagickWand

What your security team should do

• Inventory systems and containers that include ImageMagick, especially workloads that process user-supplied images or documents.
• Prioritize upgrades on hosts where `magick -distribute-cache` is enabled, reachable by multiple users, or used in shared processing environments.
• Upgrade to ImageMagick 6.9.13-48 or later, 7.1.2-23 or later, or a distribution package with the backported fix.
• Disable the distributed cache service if it is not operationally required.
• Restrict service access using host firewalls, service binding configuration, and least-privilege operating system permissions.
• Review recent process, service, and network logs for unexpected use of `magick -distribute-cache`, repeated connection attempts, or abnormal ImageMagick child processes.
• Harden image-processing environments by isolating them from sensitive files, credentials, and shared directories.