CVE-2026-47166

Analyzed Analyzed - Analysis Complete

Heap Buffer Over-Read in ImageMagick

Publication date: 2026-06-10

Last updated on: 2026-06-11

Assigner: GitHub, Inc.

Description

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-48 and 7.1.2-23, an attacker who can connect to a magick -distribute-cache service can cause a heap buffer over-read in the server process. This issue has been patched in versions 6.9.13-48 and 7.1.2-23.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-06-10

Last Modified

2026-06-11

Generated

2026-07-01

AI Q&A

2026-06-11

EPSS Evaluated

2026-06-30

NVD

CVE-2026-47166

Affected Vendors & Products

Vendor	Product	Version / Range
imagemagick	imagemagick	to 6.9.13-48 (exc)
imagemagick	imagemagick	From 7.0.0-0 (inc) to 7.1.2-23 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-287	When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
CWE-125	The product reads data past the end, or before the beginning, of the intended buffer.

Attack-Flow Graph

Executive Summary

This vulnerability exists in ImageMagick, a free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-48 and 7.1.2-23, an attacker who can connect to a magick -distribute-cache service can cause a heap buffer over-read in the server process.

Impact Analysis

The vulnerability can lead to a heap buffer over-read in the server process of ImageMagick when an attacker connects to the magick -distribute-cache service. According to the CVSS v3.1 score of 5.7, this indicates a moderate severity impact with high confidentiality impact and high availability impact, meaning sensitive information could be exposed and the service could be disrupted.

Mitigation Strategies

To mitigate this vulnerability, you should update ImageMagick to version 6.9.13-48 or later, or version 7.1.2-23 or later, where the issue has been patched.

Compliance Impact

The vulnerability impacts confidentiality and availability but not integrity. Since confidentiality is affected, this could potentially lead to unauthorized disclosure of sensitive information, which may affect compliance with standards and regulations such as GDPR and HIPAA that require protection of personal and health data.

However, the vulnerability requires high privileges and high attack complexity, and no user interaction is needed. The root causes include an out-of-bounds read and improper authentication.

No explicit information is provided about direct compliance impact or mitigation steps related to these standards.

Hi! I’m here to help you understand CVE-2026-47166. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70