CVE-2026-47165 Overview
CVE-2026-47165 affects ImageMagick, an open-source toolkit for editing and manipulating digital images. The vulnerability resides in the distributed pixel cache, which was originally designed without a challenge-response authentication model. An attacker with local access can interact with the distributed pixel cache and read sensitive image data exposed by the service. Maintainers addressed the issue in ImageMagick versions 6.9.13-48 and 7.1.2-23 by introducing an authentication mechanism. The flaw is classified as Information Disclosure under [CWE-200].
Critical Impact
An attacker with local access and high privileges can retrieve confidential pixel data served by the distributed pixel cache because the protocol lacked authentication prior to the patched releases.
Affected Products
- ImageMagick versions prior to 6.9.13-48 (6.x branch)
- ImageMagick versions prior to 7.1.2-23 (7.x branch)
- Applications and services embedding vulnerable ImageMagick libraries with distributed pixel cache enabled
Discovery Timeline
- 2026-06-10 - CVE-2026-47165 published to NVD
- 2026-06-10 - Last updated in NVD database
Technical Details for CVE-2026-47165
Vulnerability Analysis
ImageMagick supports a distributed pixel cache that lets multiple processes or hosts share pixel data over a network or local socket. The original design assumed a trusted environment and omitted any challenge-response authentication between clients and the cache server. A local attacker who can reach the pixel cache endpoint can issue cache protocol commands and obtain pixel data belonging to other users or processes. Because the cache stores raw image content, exposure can include sensitive images currently being processed by other workloads on the same host.
The issue is scoped to confidentiality. Integrity and availability metrics are unaffected, which aligns with an information disclosure pattern rather than memory corruption or code execution. Exploitation requires local access and elevated privileges, narrowing the practical attack surface to multi-tenant hosts and shared processing pipelines.
Root Cause
The root cause is a missing authentication control in the distributed pixel cache protocol. Any actor able to connect to the cache socket is implicitly trusted and served pixel data without verification. The patched releases introduce a challenge-response handshake so that only authorized clients can read or write cache entries.
Attack Vector
The attack vector is local. An attacker with a foothold on the same system as a running ImageMagick distributed pixel cache connects to the cache endpoint and issues read requests for pixel data. No user interaction is required. The vulnerability is documented in the ImageMagick GitHub Security Advisory GHSA-2rgj-gx5x-f62w.
Detection Methods for CVE-2026-47165
Indicators of Compromise
- Unexpected connections to the ImageMagick distributed pixel cache socket or port from local processes that do not normally use ImageMagick
- Processes running outdated ImageMagick binaries with version strings below 6.9.13-48 or 7.1.2-23
- Anomalous read volume from the distributed pixel cache service in process or network telemetry
Detection Strategies
- Inventory ImageMagick installations and compare reported versions against the patched releases 6.9.13-48 and 7.1.2-23
- Audit configuration files and command-line flags for -distribute-cache or equivalent options that activate the distributed pixel cache
- Correlate local socket access logs with the user accounts and processes expected to consume the pixel cache
Monitoring Recommendations
- Log and review all connections to the distributed pixel cache endpoint, including source PID and user context
- Track ImageMagick process invocations through endpoint telemetry and flag legacy versions
- Alert on new listeners binding to the default distributed pixel cache port on production hosts
How to Mitigate CVE-2026-47165
Immediate Actions Required
- Upgrade ImageMagick to version 6.9.13-48 or 7.1.2-23 or later on all affected systems
- Disable the distributed pixel cache where it is not required for the workload
- Restrict access to the pixel cache socket or port to authorized local users only
Patch Information
The ImageMagick maintainers fixed the issue in versions 6.9.13-48 and 7.1.2-23 by adding a challenge-response authentication step to the distributed pixel cache protocol. Refer to the ImageMagick GitHub Security Advisory GHSA-2rgj-gx5x-f62w for the full advisory and commit references.
Workarounds
- Run ImageMagick without the distributed pixel cache when network or cross-process cache sharing is not needed
- Constrain pixel cache endpoints to loopback interfaces and enforce strict filesystem permissions on cache sockets
- Isolate ImageMagick processing in dedicated containers or accounts so cache exposure cannot cross trust boundaries
# Verify the installed ImageMagick version meets the patched baseline
magick -version | head -n 1
# Expected: ImageMagick 7.1.2-23 or 6.9.13-48 (or later)
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
