ImageMagick 7.1.2-30 Windows TTRT Path Policy Bypass
CVE-2026-86422 Published on September 7, 2026
ImageMagick before 7.1.2-30 Path Policy TOCTOU Symlink Race
ImageMagick before 7.1.2-30 contains a time-of-check-time-of-use vulnerability in path policy enforcement on Windows that allows attackers to bypass read or write restrictions by exploiting symlink race conditions. Attackers can swap symlinks between policy validation and file access to read or write policy-denied files.
Vulnerability Analysis
CVE-2026-86422 is exploitable with local system access. This vulnerability is consided to have a high level of attack complexity. The potential impact of an exploit of this vulnerability is considered to have no impact on confidentiality and integrity and availability.
Weakness Type
What is an insecure temporary file Vulnerability?
The software attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.
CVE-2026-86422 has been classified to as an insecure temporary file vulnerability or weakness.
Products Associated with CVE-2026-86422
Want to know whenever a new CVE is published for ImageMagick? stack.watch will email you.
Affected Versions
ImageMagick:- Before 7.1.2-30 is affected.
- Version 7.1.2-30 is unaffected.
- Before 6.9.13-55 is affected.
- Version 6.9.13-55 is unaffected.