CVE-2026-109274
Received Received - Intake

Time-of-Check Time-of-Use Symlink Race in ImageMagick

Publication date: 2026-10-12

Last updated on: 2026-10-12

Assigner: VulnCheck

Description
ImageMagick before 7.1.2-32 contains a time-of-check time-of-use symlink race vulnerability that allows attackers to bypass the path security policy when executing a magick script. Attackers can swap a checked path with a symlink during script execution to read files that the security policy is meant to block.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-12
Last Modified
2026-10-12
Generated
2026-10-12
AI Q&A
2026-10-12
EPSS Evaluated
N/A
NVD
CVE-2026-109274
EUVD
EUVD-2026-97718

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
ImageMagick ImageMagick 7.0.0-0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-59 The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a time-of-check time-of-use (TOCTOU) symlink race condition in ImageMagick versions before 7.1.2-32. It allows attackers to bypass path security policies when executing a magick script by swapping a checked path with a symlink during execution to read files that should be blocked.

Detection Guidance

To detect this vulnerability, check the ImageMagick version installed on your system. Run: convert --version or magick --version. If the version is below 7.1.2-32, the system is vulnerable. Additionally, monitor for unusual file access patterns or symlink-related activities during script execution.

Impact Analysis

An attacker with local access could exploit this to read unauthorized files on your system by manipulating file paths during script execution. This could expose sensitive data if the security policy was meant to restrict access to those files.

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by allowing unauthorized file access if the security policy is bypassed. It may lead to exposure of sensitive data, violating confidentiality requirements in these regulations.

Mitigation Strategies

Immediately update ImageMagick to version 7.1.2-32 or later. If updating is not possible, restrict execution of magick scripts to trusted directories and users. Disable unnecessary file access permissions and monitor for suspicious activities related to symlink manipulation.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-109274. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart