Executive brief
ImageMagick is a widely used open-source tool for editing and converting digital images. A security flaw in its distributed cache service could allow a high-privileged local user to interfere with the application's internal file handling. While difficult to exploit due to specific timing requirements, a successful attack could lead to unauthorized access to sensitive data handled by the image processing server.
Technical details
A race condition exists in the ImageMagick 'magick -distribute-cache' service due to improper synchronization of shared resources (CWE-362, CWE-567). An attacker with high privileges and local access can exploit this timing window to hijack a file descriptor within the server process. Successful exploitation requires the attacker to win a race condition during concurrent execution, potentially leading to unauthorized confidentiality impacts. The issue is addressed in ImageMagick versions 6.9.13-48 and 7.1.2-23.
Affected products
- ImageMagick ImageMagick < 6.9.13-48, < 7.1.2-23
Timeline
- 2026-05-18: advisory: GitHub Security Advisory GHSA-4g75-9r48-jf92 published
- 2026-06-10: disclosed: CVE-2026-46693 published to NVD