CVE-2026-86422
Received Received - Intake

Path Traversal in ImageMagick via Symlink Race Condition

Publication date: 2026-09-07

Last updated on: 2026-09-07

Assigner: VulnCheck

Description
ImageMagick before 7.1.2-30 contains a time-of-check-time-of-use vulnerability in path policy enforcement on Windows that allows attackers to bypass read or write restrictions by exploiting symlink race conditions. Attackers can swap symlinks between policy validation and file access to read or write policy-denied files.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-07
Last Modified
2026-09-07
Generated
2026-09-07
AI Q&A
2026-09-07
EPSS Evaluated
N/A
NVD
CVE-2026-86422
EUVD
EUVD-2026-72380

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
imagemagick imagemagick to 7.1.2-30 (exc)
imagemagick imagemagick to 6.9.13-55 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-59 The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a time-of-check-time-of-use (TOCTOU) vulnerability in ImageMagick's path policy enforcement on Windows. Attackers exploit symlink race conditions to bypass read or write restrictions by swapping symlinks between policy validation and file access stages.

Detection Guidance

To detect this vulnerability, check if your ImageMagick version is below 7.1.2-30 or 6.9.13-55. On Windows, monitor for unusual symlink activity or file access patterns that bypass policy restrictions. Use commands like 'magick -version' to check the installed version.

Impact Analysis

An attacker with low privileges could exploit this to read or write files that should be restricted by policy. The attack requires user interaction and has high complexity but could lead to unauthorized access or modification of sensitive files.

Compliance Impact

This vulnerability could potentially affect compliance with GDPR and HIPAA by allowing unauthorized access to restricted files through symlink race conditions. If attackers bypass read or write restrictions, sensitive data might be exposed or altered, violating confidentiality and integrity requirements under these regulations.

Mitigation Strategies

Immediately upgrade ImageMagick to version 7.1.2-30 or later. If using an older branch, upgrade to 6.9.13-55 or later. Apply patches from the official ImageMagick repository or trusted sources to close the TOCTOU vulnerability.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-86422. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart