CVE-2026-47166
MediumCVSS 5.7Exploitation Probability (EPSS)
Low risk1th percentile — higher than 1% of all known CVEs
Summary
ImageMagick prior to versions 6.9.13-48 and 7.1.2-23 contained a vulnerability that allowed an attacker to cause a heap buffer over-read in the server process if they could connect to a magick -distribute-cache service.
Risk Assessment
This vulnerability could lead to the exposure of sensitive data or destabilization of the server, posing a serious threat to the organization's security.
Recommendation
It is recommended to upgrade to versions 6.9.13-48 or 7.1.2-23 to mitigate this vulnerability.
Original NVD description (English source)
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-48 and 7.1.2-23, an attacker who can connect to a magick -distribute-cache service can cause a heap buffer over-read in the server process. This issue has been patched in versions 6.9.13-48 and 7.1.2-23.