PatchSiren cyber security CVE debrief
CVE-2026-46693 ImageMagick CVE debrief
CVE-2026-46693 is a medium-severity vulnerability in ImageMagick, a free and open-source software used for editing and manipulating digital images. The vulnerability has a CVSS score of 4.1 and was published on [cvePublishedAt]. An attacker who can connect to a `magick -distribute-cache` service can hijack a file descriptor in the server process when a race condition is met. This issue has been patched in versions 6.9.13-48 and 7.1.2-23.
- Vendor
- ImageMagick
- Product
- Unknown
- CVSS
- MEDIUM 4.1
- CISA KEV
- Not listed in stored evidence
- Original CVE published
- 2026-06-10
- Original CVE updated
- 2026-06-11
- Advisory published
- 2026-06-10
- Advisory updated
- 2026-06-11
Who should care
Users of ImageMagick versions prior to 6.9.13-48 and 7.1.2-23 should be aware of this vulnerability and take steps to mitigate it.
Technical summary
The vulnerability is caused by a race condition in the `magick -distribute-cache` service, which allows an attacker to hijack a file descriptor in the server process. This can be exploited by an attacker who can connect to the service.
Defensive priority
medium
Recommended defensive actions
- Upgrade to ImageMagick versions 6.9.13-48 or 7.1.2-23 or later.
- Avoid using the `magick -distribute-cache` service in untrusted environments.
Evidence notes
The vulnerability was patched in versions 6.9.13-48 and 7.1.2-23. Users should upgrade to these versions or later to mitigate the vulnerability.
Official resources
-
CVE-2026-46693 CVE record
CVE.org
-
CVE-2026-46693 NVD detail
NVD
-
Source item URL
nvd_modified
-
Mitigation or vendor reference
[email protected] - Vendor Advisory
CVE-2026-46693 was published on [cvePublishedAt] and modified on [cveModifiedAt].