CVE-2026-86424
Received Received - Intake

ImageMagick Video Decoder TOCTOU Path Policy Bypass

Publication date: 2026-09-07

Last updated on: 2026-09-07

Assigner: VulnCheck

Description
ImageMagick before 7.1.2-30 and 6.9.13-55 contains a time-of-check-time-of-use (TOCTOU) vulnerability in the video decoder that allows attackers to bypass path policy write restrictions via symlink swaps. An attacker can replace a symlink between policy validation (check-time) and the file write operation (use-time) to write to policy-denied locations.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-07
Last Modified
2026-09-07
Generated
2026-09-07
AI Q&A
2026-09-07
EPSS Evaluated
N/A
NVD
CVE-2026-86424
EUVD
EUVD-2026-72382

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
imagemagick imagemagick to 7.1.2-30 (exc)
imagemagick imagemagick to 6.9.13-55 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-59 The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a time-of-check-time-of-use (TOCTOU) vulnerability in ImageMagick's video decoder. It allows attackers to bypass write restrictions by replacing a symlink between the policy validation phase and the actual file write operation. This enables unauthorized writes to restricted locations.

Detection Guidance

To detect this vulnerability, check the installed version of ImageMagick using the command: convert --version or identify --version. If the version is below 7.1.2-30 or 6.9.13-55, the system is vulnerable. Additionally, monitor for unusual symlink activity in directories where ImageMagick processes video files.

Impact Analysis

An attacker with local access and low privileges could exploit this to write files to locations that should be restricted by policy. This could lead to unauthorized file modifications or data corruption, though the overall impact is limited due to low severity.

Compliance Impact

This vulnerability could potentially affect compliance with standards like GDPR and HIPAA by allowing unauthorized file writes to restricted locations. If an attacker exploits this TOCTOU flaw to write files to policy-denied directories, it may lead to unauthorized data access or modification, violating data integrity and confidentiality requirements in these regulations.

Mitigation Strategies

Immediately update ImageMagick to version 7.1.2-30 or later for ImageMagick 7, or 6.9.13-55 or later for ImageMagick 6. If updating is not possible, restrict write permissions to directories where ImageMagick operates and disable video processing features if unused.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-86424. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart