PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-47165 ImageMagick CVE debrief

CVE-2026-47165 is a medium-severity vulnerability in ImageMagick, a free and open-source software for editing and manipulating digital images. Prior to versions 6.9.13-48 and 7.1.2-23, the distributed pixel cache was originally designed to operate without a challenge–response authentication model. This has been changed in versions 6.9.13-48 and 7.1.2-23. The vulnerability has a CVSS score of 4.1 and is classified as CWE-200.

Vendor
ImageMagick
Product
Unknown
CVSS
MEDIUM 4.1
CISA KEV
Not listed in stored evidence
Original CVE published
2026-06-10
Original CVE updated
2026-06-11
Advisory published
2026-06-10
Advisory updated
2026-06-11

Who should care

Users of ImageMagick versions prior to 6.9.13-48 and 7.1.2-23 should be aware of this vulnerability and take steps to mitigate it.

Technical summary

The distributed pixel cache in ImageMagick was originally designed to operate without a challenge–response authentication model. This has been changed in versions 6.9.13-48 and 7.1.2-23.

Defensive priority

medium

Recommended defensive actions

  • Upgrade to ImageMagick version 6.9.13-48 or later
  • Upgrade to ImageMagick version 7.1.2-23 or later

Evidence notes

The vulnerability was published on [cve-org](https://www.cve.org/CVERecord?id=CVE-2026-47165) and has a detailed description on [nvd](https://nvd.nist.gov/vuln/detail/CVE-2026-47165).

Official resources

CVE-2026-47165 was published on 2026-06-10T23:16:48.037Z and modified on 2026-06-11T18:42:27.697Z.