An attacker who can connect to the ImageMagick distributed pixel cache service can trigger a race condition that results in the server process hijacking a file descriptor. This flaw places the attacker in a position to manipulate file descriptors that the server may use for subsequent operations, potentially enabling unauthorized access to file contents or execution of privileged code if those descriptors are exploited. The vulnerability is described by CWE-362 (Race Condition) and CWE-567 (Incomplete Synchronization).

ImageMagick installations running versions prior to 6.9.13-48 and 7.1.2-23 are affected. The vulnerability was specifically identified in the distributed cache feature of the gendered 'magick -distribute-cache' service.

The CVSS score for this issue is 4.1, indicating a moderate impact. The exploit probability (EPSS) is not available, so there is insufficient data to assess likelihood. The vulnerability is not listed in CISA’s KEV catalog, suggesting it has not yet been widely exploited. The attacker must be able to communicate with the distributed cache service, implying that exposure of this service to untrusted networks is a prerequisite for exploitation. If that exposure exists, the race condition provides an opportunity to hijack file descriptors, which could lead to broader compromise depending on the privileges of the ImageMagick process.