4.1

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-47165

CVE-2026-47165: ImageMagick: Information Disclosure in distributed pixel cache server because it is not using a challenge–response authentication model

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-48 and 7.1.2-23, the distributed pixel cache was originally designed to operate without a challenge–response authentication model. This has been changed in versions 6.9.13-48 and 7.1.2-23.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-47165

CVE-2026-47165:

4.1

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

SSVC / BOD 26-04 ↗

Exploitation NoneAutomatable NoTech Impact Partial

Select your environment

→SSVCDeferfix on upgrade

Runtime reachability resolves your actual outcome.Book a demo

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
Magick.NET-Q16-AnyCPU	nuget	< 14.12.0	14.12.0
Magick.NET-Q16-HDRI-AnyCPU	nuget	< 14.12.0	14.12.0
Magick.NET-Q16-HDRI-OpenMP-arm64	nuget	< 14.12.0	14.12.0
Magick.NET-Q16-HDRI-arm64	nuget	< 14.12.0	14.12.0
Magick.NET-Q16-HDRI-x64	nuget	< 14.12.0	14.12.0
Magick.NET-Q16-HDRI-x86	nuget	< 14.12.0	14.12.0
Magick.NET-Q16-OpenMP-arm64	nuget	< 14.12.0	14.12.0
Magick.NET-Q16-OpenMP-x64	nuget	< 14.12.0	14.12.0
Magick.NET-Q16-arm64	nuget	< 14.12.0	14.12.0
Magick.NET-Q16-x64	nuget	< 14.12.0	14.12.0
Magick.NET-Q16-x86	nuget	< 14.12.0	14.12.0
Magick.NET-Q8-AnyCPU	nuget	< 14.12.0	14.12.0
Magick.NET-Q8-OpenMP-arm64	nuget	< 14.12.0	14.12.0
Magick.NET-Q8-OpenMP-x64	nuget	< 14.12.0	14.12.0
Magick.NET-Q8-arm64	nuget	< 14.12.0	14.12.0
Magick.NET-Q8-x64	nuget	< 14.12.0	14.12.0
Magick.NET-Q8-x86	nuget	< 14.12.0	14.12.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability lies in ImageMagick's distributed pixel cache (DPC), which lacked proper authentication and validation, allowing potential information disclosure. The analysis of the security advisory and the associated patch revealed that the core issue was the absence of checks on the data requested from the cache.

The patch, identified by comparing the repository tags before and after the patched version, is in commit bb79e91155127dd6c3c18a01c8761e9c2ea82d70. This commit modifies the file MagickCore/distribute-cache.c.

The key changes involve adding calls to a new validation function, ValidateDistributedPixelCache, within two functions responsible for reading from the cache: ReadDistributeCacheMetacontent and ReadDistributeCachePixels.

These two functions are identified as the vulnerable functions because, prior to the patch, they would process read requests for pixel and metadata from the DPC without verifying if the requested size (length) was valid for the specified image region. This flaw could be exploited by a malicious actor to read arbitrary data from the server's memory where the cache is stored, leading to an information disclosure vulnerability. The patch mitigates this by calculating the expected size and comparing it against the requested length.

Vulnerable functions

ReadDistributeCacheMetacontent

MagickCore/distribute-cache.c

This function reads metacontent from the distributed pixel cache. The patch adds a call to `ValidateDistributedPixelCache` to verify the region and length of the data being read. Before this change, the function was vulnerable to reading out-of-bounds data, leading to information disclosure, because it did not validate the incoming request size against the image's properties.

ReadDistributeCachePixels

MagickCore/distribute-cache.c

This function reads pixel data from the distributed pixel cache. The patch adds a call to `ValidateDistributedPixelCache` to ensure the requested pixel data size is valid. The vulnerability existed because, without this validation, a malicious client could request a larger data length than expected for the given image region, potentially reading arbitrary memory content from the cache server.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.