CVE-2026-46692
MediumCVSS 4.1Exploitation Probability (EPSS)
Low risk2th percentile — higher than 2% of all known CVEs
Summary
ImageMagick prior to versions 6.9.13-48 and 7.1.2-23 contained a vulnerability that allowed an attacker to perform a heap buffer over-write in the server process if they had access to the magick -distribute-cache service.
Risk Assessment
An attacker could exploit this vulnerability to gain control over the server, posing a significant security risk to the system.
Recommendation
It is recommended to upgrade to versions 6.9.13-48 or 7.1.2-23 to mitigate this vulnerability.
Original NVD description (English source)
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-48 and 7.1.2-23, an attacker who can connect to a magick -distribute-cache service can cause a heap buffer over-write in the server process. This issue has been patched in versions 6.9.13-48 and 7.1.2-23.