Magick.NET CVE-2026-47166

The vendor-released patch is Magick.NET version 14.12.0, which resolves the heap over-read in all affected Q16 package variants. Operators should upgrade all Magick.NET NuGet dependencies to >= 14.12.0 via the NuGet package manager. Advisory details are at https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-6gxq-f64p-5w6f. As an immediate compensating control for environments that cannot patch, disable or avoid starting the magick -distribute-cache service entirely - the vulnerability is only exploitable when this service is running and accessible. If the distributed cache feature is required, restrict network or local socket access to the service using host-based firewall rules or OS-level access controls (e.g., bind only to loopback, restrict with iptables/nftables), limiting connection attempts to known trusted processes only. Note that disabling the distribute-cache service will remove distributed processing capability and may degrade performance in high-throughput imaging pipelines.