Junglewise Threat Intelligence

CVE-2026-46693: ImageMagick race condition in distribute-cache service

CVE-2026-46693 · Severity: medium · CVSS 4.1 · Published 2026-06-10

Technologies: Magick.NET-Q16-OpenMP-arm64 (NuGet), Magick.NET-Q16-AnyCPU (NuGet), Magick.NET-Q16-HDRI-AnyCPU (NuGet), Magick.NET-Q8-x86 (NuGet), Magick.NET-Q8-AnyCPU (NuGet), Magick.NET-Q16-arm64 (NuGet), Magick.NET-Q16-OpenMP-x64 (NuGet), Magick.NET-Q16-HDRI-arm64 (NuGet), Magick.NET-Q16-HDRI-x86 (NuGet), Magick.NET-Q16-HDRI-x64 (NuGet), Magick.NET-Q8-OpenMP-arm64 (NuGet), Magick.NET-Q8-OpenMP-x64 (NuGet), ImageMagick, Magick.NET-Q16-x64 (NuGet), Magick.NET-Q8-arm64 (NuGet), Magick.NET-Q8-x64 (NuGet), Magick.NET-Q16-x86 (NuGet), Magick.NET-Q16-HDRI-OpenMP-arm64 (NuGet). Vendors: NuGet, ImageMagick.

Executive brief

ImageMagick is a widely used open-source tool for editing and converting digital images. A security flaw in its distributed cache service could allow a high-privileged local user to interfere with the application's internal file handling. While difficult to exploit due to specific timing requirements, a successful attack could lead to unauthorized access to sensitive data handled by the image processing server.

Technical details

A race condition exists in the ImageMagick 'magick -distribute-cache' service due to improper synchronization of shared resources (CWE-362, CWE-567). An attacker with high privileges and local access can exploit this timing window to hijack a file descriptor within the server process. Successful exploitation requires the attacker to win a race condition during concurrent execution, potentially leading to unauthorized confidentiality impacts. The issue is addressed in ImageMagick versions 6.9.13-48 and 7.1.2-23.

Affected products

  • ImageMagick ImageMagick < 6.9.13-48, < 7.1.2-23

Timeline

  • 2026-05-18: advisory: GitHub Security Advisory GHSA-4g75-9r48-jf92 published
  • 2026-06-10: disclosed: CVE-2026-46693 published to NVD

References

Related threats