ImageMagick < 6.9.13-48/7.1.2-23: FD Hijack via race in magick-distribute-cache
CVE-2026-46693 Published on June 10, 2026
ImageMagick: Race Condition in distributed pixel cache server can result in file descriptor hijacking
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-48 and 7.1.2-23, an attacker who can connect to a magick -distribute-cache service can hijack a file descriptor in the server process when a race condition is met. This issue has been patched in versions 6.9.13-48 and 7.1.2-23.
Vulnerability Analysis
CVE-2026-46693 can be exploited with local system access, and requires user privileges. This vulnerability is consided to have a high level of attack complexity. The potential impact of an exploit of this vulnerability is considered to have a high impact on confidentiality, with no impact on integrity and availability.
Weakness Types
What is a Race Condition Vulnerability?
The program contains a code sequence that can run concurrently with other code, and the code sequence requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence that is operating concurrently.
CVE-2026-46693 has been classified to as a Race Condition vulnerability or weakness.
Unsynchronized Access to Shared Data in a Multithreaded Context
The product does not properly synchronize shared data, such as static variables across threads, which can lead to undefined behavior and unpredictable data changes.
Products Associated with CVE-2026-46693
Want to know whenever a new CVE is published for ImageMagick? stack.watch will email you.
Affected Versions
ImageMagick:- Version < 6.9.13-48 is affected.
- Version < 7.1.2-23 is affected.