CVE-2026-46693: ImageMagick Remote File Descriptor Hijacking via Race Condition | Securin

Zero-Day Research/CVE-2026-46693

▲ MediumCVSS 4.1

ImageMagick Remote File Descriptor Hijacking via Race Condition

https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-4g75-9r48-jf92

CVE IDCVE-2026-46693

CVSS v3.14.1 Medium

VendorImageMagick

CWECWE-362 Race Condition · CWE-567 Unsynchronized Shared Data Access

DisclosedMay 13, 2026

StatusPublished

01Description
02References

01/Description

What this actually is.

Technical background, root cause, and affected surface.

https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-4g75-9r48-jf92

Vendor: ImageMagick
Product: ImageMagick
Severity: Medium
CVSS Score: 4.1
Status: Published
Vector: CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N
CWE: CWE-362 Race Condition · CWE-567 Unsynchronized Shared Data Access

02/References

Cite, verify, go deeper.

Primary sources — NVD, CISA KEV, and machine-readable IoC feed.

NVD

NVD — CVE-2026-46693

nvd.nist.gov/vuln/detail/CVE-2026-46693 →

SEC

Securin VI — Full Technical Analysis

vi.securin.io →

Let Securin level up your security posture.

Get a live exposure assessment, threat-actor briefing tailored to your sector, and IoC mapping for your SIEM.

Browse all advisories

Zero Days

Securin's zero-day research operation combines frontier AI models with a decade of offensive expertise — discovering, validating, and coordinating the disclosure of high-impact vulnerabilities at a scale and speed no human team achieves alone.

Glossary

© 2026 Securin Inc · CVE Numbering Authority

Privacy Policy·Data Processing Addendum