CVE-2026-46692: ImageMagick Buffer Overflow Vulnerability

CVE-2026-46692 Overview

CVE-2026-46692 is a heap buffer overflow vulnerability in ImageMagick, the open-source image manipulation library. The flaw exists in the magick -distribute-cache service, which provides distributed pixel cache functionality across networked processes. An attacker who can connect to the distributed cache service can trigger a heap buffer over-write in the server process. The vulnerability affects ImageMagick versions prior to 6.9.13-48 and 7.1.2-23. The issue is classified under CWE-122 (Heap-based Buffer Overflow).

Critical Impact
Successful exploitation causes a heap buffer over-write in the ImageMagick distributed cache server, leading to process crashes and potential memory corruption affecting availability.

Affected Products

ImageMagick versions prior to 6.9.13-48
ImageMagick versions prior to 7.1.2-23
Systems exposing the magick -distribute-cache service

Discovery Timeline

2026-06-10 - CVE-2026-46692 published to NVD
2026-06-10 - Last updated in NVD database

Technical Details for CVE-2026-46692

Vulnerability Analysis

The vulnerability resides in ImageMagick's distributed pixel cache subsystem. ImageMagick provides a -distribute-cache mode that allows pixel cache data to be shared across processes over a network socket. The server component accepts connections and processes cache requests from clients. A flaw in the request handling logic permits an attacker who can connect to the service to trigger a heap-based buffer over-write within the server process memory space.

Heap buffer over-writes can corrupt adjacent allocations, function pointers, or heap metadata. The immediate impact is loss of availability through process crashes. Depending on heap layout and allocator behavior, controlled memory corruption may also be possible. The CVSS vector indicates a local attack vector with high attack complexity and high privileges required.

Root Cause

The root cause is improper bounds validation when processing data received by the distributed cache service. The server fails to enforce correct size constraints on incoming requests before writing data into a heap-allocated buffer. This allows the write operation to exceed the intended buffer boundary.

Attack Vector

Exploitation requires the attacker to establish a connection to a running magick -distribute-cache instance. The attacker must already possess high privileges on the local system, and exploitation involves high complexity due to constraints on triggering the corruption reliably. The attacker sends crafted cache protocol messages that cause the server to write beyond an allocated heap buffer. See the GitHub Security Advisory GHSA-p93h-f2jc-477j for technical details.

// No verified proof-of-concept code is publicly available.
// Refer to the upstream advisory for technical analysis.

Detection Methods for CVE-2026-46692

Indicators of Compromise

Unexpected crashes or core dumps from magick processes running with the -distribute-cache argument
Abnormal network connections to ImageMagick distributed cache listening ports from unexpected sources
Heap corruption signatures in system logs or dmesg output referencing ImageMagick binaries

Detection Strategies

Inventory all hosts running ImageMagick and identify versions older than 6.9.13-48 (6.x branch) or 7.1.2-23 (7.x branch)
Audit process command lines for the -distribute-cache flag to identify exposed services
Monitor for repeated connection attempts or malformed protocol traffic targeting the distributed cache port

Monitoring Recommendations

Enable process crash telemetry and forward magick process termination events to a central log collector
Track outbound and inbound connections involving distributed cache ports for behavioral baselining
Alert on new instances of magick -distribute-cache starting on production hosts where the service is not authorized

How to Mitigate CVE-2026-46692

Immediate Actions Required

Upgrade ImageMagick to version 6.9.13-48 or 7.1.2-23 or later on all affected systems
Restrict network access to any host running magick -distribute-cache to trusted client addresses only
Disable the distributed cache service on systems where it is not explicitly required

Patch Information

The ImageMagick maintainers released fixes in versions 6.9.13-48 and 7.1.2-23. Patch details are documented in the GitHub Security Advisory GHSA-p93h-f2jc-477j. Apply distribution package updates as soon as vendor-rebuilt packages become available.

Workarounds

Do not run magick with the -distribute-cache option in environments where untrusted local users can connect to the service
Use host-based firewall rules to limit access to the distributed cache listening port
Run ImageMagick under a low-privilege service account and apply seccomp or AppArmor profiles to constrain the process

bash

# Verify installed ImageMagick version
magick -version | head -n 1

# Example firewall restriction (replace PORT and TRUSTED_CIDR)
iptables -A INPUT -p tcp --dport PORT -s TRUSTED_CIDR -j ACCEPT
iptables -A INPUT -p tcp --dport PORT -j DROP