Listen to this Post
The distributed pixel cache server (magick -distribute-cache) listens on a TCP port and forks a child process to handle each client connection. When the child opens the pixel cache file on disk, a race window exists between the open() call and the subsequent fcntl() that sets the FD_CLOEXEC flag. An attacker with network access to the cache server can send a carefully timed request that triggers a fork and exec of a sub-process while the file descriptor still lacks close-on-exec. The sub-process inherits the open descriptor, allowing the attacker to read or write the pixel cache data of other clients. The attacker may also manipulate the inherited descriptor to corrupt cache state or leak sensitive image data from concurrent server operations. The race is feasible because the server uses a shared cache directory and predictable file naming. This vulnerability requires the distributed cache feature to be explicitly enabled. The race condition can be exploited without authentication if the server binds to a network‑accessible interface. Successful exploitation leads to information disclosure or denial of service through cache corruption.
Platform: ImageMagick
Version: 7.1.0-27
Vulnerability: Race Condition
Severity: Moderate
date: May 18, 2026
Prediction: Patch May 20, 2026
What Undercode Say:
Analytics:
Check if distributed cache is active ps aux | grep 'magick -distribute-cache' netstat -tlnp | grep 2000 default port often 2000 Identify ImageMagick version identify -version | head -1 Monitor file descriptors during race (requires inotify) inotifywait -m /tmp/magick- &
Exploit:
Slowloris-style connection to extend race window while true; do exec 3<>/dev/tcp/192.168.1.10/2000 echo -n '' >&3 & sleep 0.01 done & Trigger fork while fd inherited ncat 192.168.1.10 2000 < /dev/zero
Protection from this CVE:
- Disable distributed cache if not required.
- Restrict server to localhost (127.0.0.1).
- Apply vendor update to ImageMagick ≥ 7.1.0-28.
Impact:
Remote unauthenticated attackers with network access to the pixel cache server can hijack file descriptors, leading to disclosure of image data or corruption of cached pixel information, potentially causing crashes or serving manipulated images.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
