Executive brief
ImageMagick is a widely-used image processing library that enforces security policies to restrict file read/write access. A timing vulnerability in policy enforcement on Windows allows attackers with local access to swap symbolic links and bypass these restrictions, potentially reading or modifying files that should be protected by policy rules.
Technical details
A time-of-check-time-of-use (TOCTOU) vulnerability exists in ImageMagick's Windows path policy enforcement mechanism (CWE-59: Improper Link Resolution Before File Access). The vulnerability allows attackers to perform a symlink-swap race condition: after policy validation checks a symlink target, an attacker can replace the symlink to point to a different file before actual file access occurs. This requires local system access, low privileges, and user interaction. An attacker can read or write files that policy rules would normally deny. The vulnerability is patched in ImageMagick 7.1.2-30 and 6.9.13-55.
Affected products
- ImageMagick ImageMagick before 7.1.2-30 and before 6.9.13-55
Timeline
- 2026-08-23: disclosed: Published as GitHub Security Advisory GHSA-x8g2-7r3w-h44p
- 2026-09-07: advisory: CVE-2026-86422 assigned
- 2026-08-23: patched: Fixed in versions 7.1.2-30 and 6.9.13-55