Skip to content
← Vulnerability catalog
OFFICIAL CVE RECORD1.0 Low

CVE-2026-86422

ImageMagick before 7.1.2-30 Path Policy TOCTOU Symlink Race

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
VulnCheck

Description

ImageMagick before 7.1.2-30 contains a time-of-check-time-of-use vulnerability in path policy enforcement on Windows that allows attackers to bypass read or write restrictions by exploiting symlink race conditions. Attackers can swap symlinks between policy validation and file access to read or write policy-denied files.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

ImageMagick ImageMagick

Default version status: unaffected

  • 7.0.0 to < 7.1.2-30affected
  • 7.1.2-30unaffected

ImageMagick ImageMagick

Default version status: unaffected

  • 0 to < 6.9.13-55affected
  • 6.9.13-55unaffected

References