CVE-2026-47166: ImageMagick Buffer Overflow Vulnerability

CVE-2026-47166 Overview

CVE-2026-47166 is a heap buffer over-read vulnerability in ImageMagick, the open-source image editing and manipulation suite. The flaw affects the magick -distribute-cache service, which provides a remote pixel cache for distributed image processing. An attacker who can connect to the distribute-cache service can trigger an out-of-bounds read in the server process, exposing adjacent heap memory or causing the service to crash. The vulnerability is classified under [CWE-125] (Out-of-Bounds Read). It is patched in ImageMagick versions 6.9.13-48 and 7.1.2-23.

Critical Impact
An authenticated local attacker with access to the distribute-cache service can read heap memory contents and disrupt service availability.

Affected Products

ImageMagick versions prior to 6.9.13-48 (6.x branch)
ImageMagick versions prior to 7.1.2-23 (7.x branch)
Systems exposing the magick -distribute-cache service

Discovery Timeline

2026-06-10 - CVE-2026-47166 published to NVD
2026-06-10 - Last updated in NVD database

Technical Details for CVE-2026-47166

Vulnerability Analysis

ImageMagick's distribute-cache service allows multiple ImageMagick instances to share a pixel cache over a network socket. The service handles client requests for reading and writing pixel regions in a centralized cache process. The vulnerability stems from insufficient bounds validation when the server processes attacker-controlled request parameters. A malicious client can craft a request that causes the server to read beyond the bounds of an allocated heap buffer.

The out-of-bounds read may disclose adjacent heap memory contents back to the attacker through service responses. It can also trigger a process crash, denying service to legitimate clients. The issue is local in nature because the attack requires the ability to connect to the cache service, which is typically not exposed beyond trusted boundaries. The flaw carries high attack complexity and requires high privileges, limiting opportunistic exploitation.

Root Cause

The root cause is missing or incorrect length validation on client-supplied offsets or sizes used to index into pixel cache buffers within the distribute-cache server. When these parameters exceed the bounds of the underlying heap allocation, the server reads memory outside the intended region. This corresponds to [CWE-125] Out-of-Bounds Read.

Attack Vector

An attacker must first establish a connection to the magick -distribute-cache service. After authenticating or otherwise satisfying access requirements, the attacker sends malformed cache requests with invalid offset or length fields. The server processes the request, dereferences the attacker-controlled bounds, and reads past the end of the heap buffer. Resulting data may be returned in the response, leaking sensitive heap content such as image data, credentials, or pointers. See the GitHub Security Advisory GHSA-6gxq-f64p-5w6f for additional technical details.

No public proof-of-concept code is currently available for this issue.

Detection Methods for CVE-2026-47166

Indicators of Compromise

Unexpected crashes or restarts of magick processes running the distribute-cache service
Anomalous inbound connections to the distribute-cache listener port from untrusted hosts
Malformed or oversized cache request payloads in network captures
Memory access violations or segmentation faults logged for ImageMagick binaries

Detection Strategies

Inventory hosts running ImageMagick and identify those launching magick -distribute-cache
Compare installed ImageMagick versions against the patched releases 6.9.13-48 and 7.1.2-23
Inspect process telemetry for magick crashes correlated with inbound network activity
Apply network IDS signatures that detect malformed distribute-cache protocol fields

Monitoring Recommendations

Log all connections to the distribute-cache service port and alert on connections from non-allowlisted sources
Monitor process exit codes and core dumps for ImageMagick servers
Track outbound data volume from distribute-cache hosts to detect potential memory disclosure

How to Mitigate CVE-2026-47166

Immediate Actions Required

Upgrade ImageMagick to version 6.9.13-48 or 7.1.2-23 or later on all affected systems
Restrict network access to the distribute-cache service using host-based or network firewalls
Audit deployments to confirm the distribute-cache service is not exposed to untrusted networks
Rebuild and redeploy container images that bundle vulnerable ImageMagick binaries

Patch Information

The ImageMagick maintainers fixed the vulnerability in releases 6.9.13-48 and 7.1.2-23. Patch details and source references are available in the ImageMagick GitHub Security Advisory. Operators should update both the 6.x and 7.x branches depending on which is deployed.

Workarounds

Disable the magick -distribute-cache service if distributed pixel caching is not required
Bind the distribute-cache listener to localhost or a private interface only
Enforce strict authentication and IP allowlisting on the service socket
Run ImageMagick under a least-privileged service account to limit impact of memory disclosure

bash

# Verify installed ImageMagick version
magick -version

# Block external access to the distribute-cache port (example using iptables)
iptables -A INPUT -p tcp --dport 6668 -s 127.0.0.1 -j ACCEPT
iptables -A INPUT -p tcp --dport 6668 -j DROP