PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-47166 ImageMagick CVE debrief

CVE-2026-47166 is a medium-severity vulnerability in ImageMagick, a free and open-source software for editing and manipulating digital images. An attacker who can connect to a `magick -distribute-cache` service can cause a heap buffer over-read in the server process. This issue has been patched in versions 6.9.13-48 and 7.1.2-23.

Vendor
ImageMagick
Product
Unknown
CVSS
MEDIUM 5.7
CISA KEV
Not listed in stored evidence
Original CVE published
2026-06-10
Original CVE updated
2026-06-11
Advisory published
2026-06-10
Advisory updated
2026-06-11

Who should care

Users of ImageMagick versions prior to 6.9.13-48 and 7.1.2-23 should update to the latest patched versions to prevent potential heap buffer over-read attacks.

Technical summary

The vulnerability exists in the `magick -distribute-cache` service, allowing an attacker to cause a heap buffer over-read in the server process. The CVSS score for this vulnerability is 5.7, with a severity rating of MEDIUM.

Defensive priority

MEDIUM

Recommended defensive actions

  • Update to ImageMagick versions 6.9.13-48 or 7.1.2-23 or later.
  • Restrict access to the `magick -distribute-cache` service to trusted users only.

Evidence notes

The CVE-2026-47166 vulnerability was published on [cve-org](https://www.cve.org/CVERecord?id=CVE-2026-47166) and has a detailed analysis on [nvd](https://nvd.nist.gov/vuln/detail/CVE-2026-47166).

Official resources

CVE-2026-47166 was published on 2026-06-10T23:16:48.180Z and modified on 2026-06-11T18:42:44.020Z.