4.1

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-46693

CVE-2026-46693: ImageMagick: Race Condition in distributed pixel cache server can result in file descriptor hijacking

An attacker who can connect to a magick -distribute-cache service can hijack a file descriptor in the server process when a race condition is met.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-46693

CVE-2026-46693:

4.1

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
Magick.NET-Q16-AnyCPU	nuget	< 14.12.0	14.12.0
Magick.NET-Q16-HDRI-AnyCPU	nuget	< 14.12.0	14.12.0
Magick.NET-Q16-HDRI-OpenMP-arm64	nuget	< 14.12.0	14.12.0
Magick.NET-Q16-HDRI-arm64	nuget	< 14.12.0	14.12.0
Magick.NET-Q16-HDRI-x64	nuget	< 14.12.0	14.12.0
Magick.NET-Q16-HDRI-x86	nuget	< 14.12.0	14.12.0
Magick.NET-Q16-OpenMP-arm64	nuget	< 14.12.0	14.12.0
Magick.NET-Q16-OpenMP-x64	nuget	< 14.12.0	14.12.0
Magick.NET-Q16-arm64	nuget	< 14.12.0	14.12.0
Magick.NET-Q16-x64	nuget	< 14.12.0	14.12.0
Magick.NET-Q16-x86	nuget	< 14.12.0	14.12.0
Magick.NET-Q8-AnyCPU	nuget	< 14.12.0	14.12.0
Magick.NET-Q8-OpenMP-arm64	nuget	< 14.12.0	14.12.0
Magick.NET-Q8-OpenMP-x64	nuget	< 14.12.0	14.12.0
Magick.NET-Q8-arm64	nuget	< 14.12.0	14.12.0
Magick.NET-Q8-x64	nuget	< 14.12.0	14.12.0
Magick.NET-Q8-x86	nuget	< 14.12.0	14.12.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a race condition in the ImageMagick distributed pixel cache server. The core of the vulnerability lies in the DistributePixelCacheServer function, which handles incoming client connections. When a new connection is accepted, a new thread is created to handle it. The vulnerability arises because the socket descriptor for the new connection was passed to the thread as a pointer to a variable on the main thread's stack. If new connections arrived in rapid succession, this stack variable could be overwritten with a new socket descriptor before the previously created thread had a chance to read it. This could lead to a situation where two threads would be using the same socket descriptor, or a thread could be using a closed and reused file descriptor, resulting in a file descriptor hijacking.

The fix involves changing the way the socket descriptor is passed to the handler thread. Instead of passing a pointer to a stack variable, the patched code allocates memory on the heap for each new connection's socket descriptor. A pointer to this heap-allocated memory is then passed to the new thread. This ensures that each thread gets a unique and stable pointer to its socket descriptor, thus eliminating the race condition.

In addition to fixing the race condition, the patches also introduced more robust validation of data received from the client in functions like WriteDistributeCacheMetacontent, WriteDistributeCachePixels, ReadDistributeCacheMetacontent, and ReadDistributeCachePixels. These changes prevent potential buffer and heap overflows by validating the size of the incoming data before processing it. While these are separate from the race condition, they are part of the overall security hardening of the distributed pixel cache functionality.

Vulnerable functions

DistributePixelCacheServer

MagickCore/distribute-cache.c

This function is vulnerable to a race condition. It accepts new client connections in a loop and creates a new thread to handle each connection. The vulnerability lies in how the client socket descriptor was passed to the new thread. It was passed as a pointer to a variable on the stack of the main thread's loop. If a new connection arrived quickly, this variable could be overwritten before the previously created thread had a chance to read it, leading to a file descriptor hijacking.

DistributePixelCacheClient

MagickCore/distribute-cache.c

This function is the thread handler for client connections. It was modified as part of the fix to correctly receive the client socket descriptor from the main server loop. The original code was not directly vulnerable, but its modification was essential to fix the race condition in `DistributePixelCacheServer`.

WriteDistributeCacheMetacontent

MagickCore/distribute-cache.c

This function writes metacontent to the distributed cache. It was vulnerable to a buffer overflow because it did not properly validate the length of the incoming data against the size of the destination buffer. An attacker could send a crafted message with a large length value, causing a buffer overflow.

WriteDistributeCachePixels

MagickCore/distribute-cache.c

This function writes pixel data to the distributed cache. Similar to `WriteDistributeCacheMetacontent`, it was vulnerable to a buffer overflow because it did not validate the length of the incoming pixel data. An attacker could exploit this to write arbitrary data beyond the allocated buffer.

ReadDistributeCacheMetacontent

MagickCore/distribute-cache.c

This function reads metacontent from the distributed cache. The vulnerability was that it did not validate the received data size, which could lead to a heap overflow if a malicious client sent a crafted message. The patch adds a call to `ValidateDistributedPixelCache` to perform this validation.

ReadDistributeCachePixels

MagickCore/distribute-cache.c

This function reads pixel data from the distributed cache. Similar to `ReadDistributeCacheMetacontent`, it was vulnerable to a heap overflow due to a lack of validation of the incoming data size. The patch introduces a call to `ValidateDistributedPixelCache` to mitigate this.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.