CVE-2026-86422

EUVD-2026-72380
ImageMagick before 7.1.2-30 contains a time-of-check-time-of-use vulnerability in path policy enforcement on Windows that allows attackers to bypass read or write restrictions by exploiting symlink race conditions. Attackers can swap symlinks between policy validation and file access to read or write policy-denied files.
Link Following
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
3.3 LOW
LOCAL
HIGH
LOW
CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N
Awaiting analysis
This vulnerability is currently awaiting analysis.
Base Score
CVSS 3.x
EPSS Score
Percentile: 1.32%
Debian logo
Debian Releases
Debian Product
Codename
imagemagick
bookworm
8:6.9.11.60+dfsg-1.6+deb12u11
fixed
bookworm (security)
8:6.9.11.60+dfsg-1.6+deb12u13
fixed
forky
8:7.1.2.29+dfsg2-1
fixed
sid
8:7.1.2.29+dfsg2-1
fixed
trixie
8:7.1.1.43+dfsg1-1+deb13u10
fixed
trixie (security)
8:7.1.1.43+dfsg1-1+deb13u11
fixed
Common Weakness Enumeration
Vulnerability Media Exposure
References
https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-x8g2-7r3w-h44p
https://www.vulncheck.com/advisories/imagemagick-before-7.1.2-30-path-policy-toctou-symlink-race