Magick.NET CVE-2026-47165

Vendor-released patch: Magick.NET 14.12.0 (all package variants). Upgrade all affected Magick.NET NuGet packages to version 14.12.0 or later, which introduces a challenge-response authentication model for the distributed pixel cache server. Reference the GitHub Security Advisory at https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-2rgj-gx5x-f62w for upgrade guidance. As a compensating control for environments that cannot immediately upgrade, disable the distributed pixel cache feature entirely by not configuring a remote pixel cache server - this eliminates the attack surface with the trade-off that distributed image processing will fall back to local disk or memory cache, potentially impacting throughput in high-volume pipelines. Additionally, network-level access controls (host-based firewall rules restricting connections to the pixel cache port) can reduce exposure, though they do not address the authentication weakness and should not substitute for patching.