CVE-2026-47166 - ImageMagick: Heap Buffer Over-Read in distributed pixel cache server

Back Back to CVE browser

MEDIUM

ImageMagick: Heap Buffer Over-Read in distributed pixel cache server

Published Jun 10, 2026

6.0

MEDIUM

CVSS 3.1

EPSS 0.13%

Description

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-48 and 7.1.2-23, an attacker who can connect to a magick -distribute-cache service can cause a heap buffer over-read in the server process. This issue has been patched in versions 6.9.13-48 and 7.1.2-23.

Affected products

Vendor ImageMagick Product ImageMagick Default
n/a
- Version
  < 6.9.13-48
  Status
  affected
  Constraints
  -
- Version
  < 7.1.2-23
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

ImageMagick

n/a

Version	Status	Constraints
< 6.9.13-48	affected	-
< 7.1.2-23	affected	-

Red Hat Enterprise Linux 6

ImageMagick

Fix deferred
Red Hat Enterprise Linux 7

ImageMagick

Fix deferred

Product	Package	State	Advisory
Red Hat Enterprise Linux 6	ImageMagick	Fix deferred	n/a
Red Hat Enterprise Linux 7	ImageMagick	Fix deferred	n/a

Remediation

Red Hat statement

Moderate: This flaw in ImageMagick could lead to information disclosure and denial of service. Exploitation requires an attacker to have high privileges and local access to the system, specifically targeting the `magick -distribute-cache` service. This limits the overall risk in typical Red Hat Enterprise Linux deployments.

Weaknesses (2)

CWE-125

Out-of-bounds Read

CWE-287

Improper Authentication

References (6)

https://access.redhat.com/security/cve/CVE-2026-47166
Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2487748
Issue Tracking
https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-6gxq-f64p-5w6f
x_refsource_CONFIRMVendor Advisory
https://github.com/advisories/GHSA-6gxq-f64p-5w6f
Advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-47166
https://www.cve.org/CVERecord?id=CVE-2026-47166

Link	Providers	Tags
https://access.redhat.com/security/cve/CVE-2026-47166		Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2487748		Issue Tracking
https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-6gxq-f64p-5w6f		x_refsource_CONFIRMVendor Advisory
https://github.com/advisories/GHSA-6gxq-f64p-5w6f		Advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-47166
https://www.cve.org/CVERecord?id=CVE-2026-47166