CVE-2026-106570: ImageMagick: Denial of service in distributed pixel cache server
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-32, an unauthenticated adjacent-network client can repeatedly connect to the distributed pixel cache server and exhaust its available connections, causing denial of service. This issue is fixed in version 7.1.2-32.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ImageMagickto a version that resolves this vulnerability.Fixed in 7.1.2-32
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Deployments running the distributed pixel cache server in ImageMagick versions prior to 7.1.2-32 are exposed. The attacker must be on an adjacent network.
Does exploitation require authentication or user interaction?
No. An unauthenticated client can exploit the issue, and no user interaction is required.
What is the practical impact of exploitation?
An attacker can repeatedly connect to exhaust the distributed pixel cache server's available connections, causing denial of service. The provided scoring indicates availability impact only, with no confidentiality or integrity impact.
What should be done to remediate the issue?
Upgrade ImageMagick to version 7.1.2-32, which fixes the issue.