CVE-2026-46693
MediumCVSS 4.1Exploitation Probability (EPSS)
Low risk1th percentile — higher than 1% of all known CVEs
Summary
ImageMagick prior to versions 6.9.13-48 and 7.1.2-23 contained a vulnerability that allowed an attacker to hijack a file descriptor in the server process when a race condition occurred. This issue has been patched in the mentioned versions.
Risk Assessment
Attackers could exploit this vulnerability to gain control over the server process, potentially leading to unauthorized access to data or services.
Recommendation
It is recommended to upgrade to versions 6.9.13-48 or 7.1.2-23 to mitigate this vulnerability.
Original NVD description (English source)
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-48 and 7.1.2-23, an attacker who can connect to a magick -distribute-cache service can hijack a file descriptor in the server process when a race condition is met. This issue has been patched in versions 6.9.13-48 and 7.1.2-23.