CVE-2026-86422
ImageMagick before 7.1.2-30 Path Policy TOCTOU Symlink Race
ImageMagick before 7.1.2-30 contains a time-of-check-time-of-use vulnerability in path policy enforcement on Windows that allows attackers to bypass read or write restrictions by exploiting symlink race conditions. Attackers can swap symlinks between policy validation and file access to read or write policy-denied files.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- High
- Privileges needed
- Low
- User interaction
- Passive
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
ImageMagick before 7.1.2-30 Path Policy TOCTOU Symlink Race
ImageMagick before 7.1.2-30 contains a time-of-check-time-of-use vulnerability in path policy enforcement on Windows that allows attackers to bypass read or write restrictions by exploiting symlink race conditions. Attackers can swap symlinks between policy validation and file access to read or write policy-denied files.
- Record
CVE-2026-86422- CVSS 4.0
- 1.0 Low
CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N - CVSS 3.1
- 3.3 Low
CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N - Weakness
- CWE-59
- Updated
- 2026-11-02
EUVDEUVD-2026-72380
ImageMagick before 7.1.2-30 contains a time-of-check-time-of-use vulnerability in path policy enforcement on Windows that allows attackers to bypass read or write restrictions by exploiting symlink race conditions. Attackers can swap symlinks between policy validation and file access to read or write policy-denied files.
- Record
EUVD-2026-72380- CVSS 4.0
- 1.0 Low
CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-66p9-q2qw-cpw8
ImageMagick before 7.1.2-30 contains a time-of-check-time-of-use vulnerability in path policy...
ImageMagick before 7.1.2-30 contains a time-of-check-time-of-use vulnerability in path policy enforcement on Windows that allows attackers to bypass read or write restrictions by exploiting symlink race conditions. Attackers can swap symlinks between policy validation and file access to read or write policy-denied files.
- Record
GHSA-66p9-q2qw-cpw8- CVSS 4.0
- 1.0 Low
CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - CVSS 3.1
- 3.3 Low
CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N - Weakness
- CWE-59
- Updated
- 2026-11-02
NVD
ImageMagick before 7.1.2-30 contains a time-of-check-time-of-use vulnerability in path policy enforcement on Windows that allows attackers to bypass read or write restrictions by exploiting symlink race conditions. Attackers can swap symlinks between policy validation and file access to read or write policy-denied files.
- Record
CVE-2026-86422- CVSS 4.0
- 1.0 Low
CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - CVSS 3.1
- 3.3 Low
CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N - CVSS 3.1
- 3.3 Low
CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N - Weakness
- CWE-59
- Updated
- 2026-11-02
OSV
ImageMagick before 7.1.2-30 Path Policy TOCTOU Symlink Race
ImageMagick before 7.1.2-30 contains a time-of-check-time-of-use vulnerability in path policy enforcement on Windows that allows attackers to bypass read or write restrictions by exploiting symlink race conditions. Attackers can swap symlinks between policy validation and file access to read or write policy-denied files.
- Record
CVE-2026-86422- CVSS 4.0
- 1.0 Low
CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N - Weakness
- CWE-59
- Updated
- 2026-11-02
OSVUBUNTU-CVE-2026-86422
ImageMagick before 7.1.2-30 contains a time-of-check-time-of-use vulnerability in path policy enforcement on Windows that allows attackers to bypass read or write restrictions by exploiting symlink race conditions. Attackers can swap symlinks between policy validation and file access to read or write policy-denied files.
- Record
UBUNTU-CVE-2026-86422- CVSS 4.0
- 1.0 Low
CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N - CVSS 3.1
- 3.3 Low
CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N - Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
imagemagickUbuntu:Pro:14.04:LTS | All versions, plus listed versions 8:6.7.7.10-5ubuntu38:6.7.7.10-5ubuntu48:6.7.7.10-6ubuntu18:6.7.7.10-6ubuntu28:6.7.7.10-6ubuntu3 Show 39 moreShow less8:6.7.7.10-6ubuntu3.18:6.7.7.10-6ubuntu3.28:6.7.7.10-6ubuntu3.38:6.7.7.10-6ubuntu3.48:6.7.7.10-6ubuntu3.58:6.7.7.10-6ubuntu3.68:6.7.7.10-6ubuntu3.78:6.7.7.10-6ubuntu3.88:6.7.7.10-6ubuntu3.98:6.7.7.10-6ubuntu3.118:6.7.7.10-6ubuntu3.128:6.7.7.10-6ubuntu3.138:6.7.7.10-6ubuntu3.13+esm18:6.7.7.10-6ubuntu3.13+esm28:6.7.7.10-6ubuntu3.13+esm38:6.7.7.10-6ubuntu3.13+esm48:6.7.7.10-6ubuntu3.13+esm58:6.7.7.10-6ubuntu3.13+esm68:6.7.7.10-6ubuntu3.13+esm78:6.7.7.10-6ubuntu3.13+esm88:6.7.7.10-6ubuntu3.13+esm98:6.7.7.10-6ubuntu3.13+esm108:6.7.7.10-6ubuntu3.13+esm118:6.7.7.10-6ubuntu3.13+esm128:6.7.7.10-6ubuntu3.13+esm138:6.7.7.10-6ubuntu3.13+esm148:6.7.7.10-6ubuntu3.13+esm158:6.7.7.10-6ubuntu3.13+esm168:6.7.7.10-6ubuntu3.13+esm178:6.7.7.10-6ubuntu3.13+esm188:6.7.7.10-6ubuntu3.13+esm198:6.7.7.10-6ubuntu3.13+esm208:6.7.7.10-6ubuntu3.13+esm218:6.7.7.10-6ubuntu3.13+esm228:6.7.7.10-6ubuntu3.13+esm238:6.7.7.10-6ubuntu3.13+esm248:6.7.7.10-6ubuntu3.13+esm258:6.7.7.10-6ubuntu3.13+esm268:6.7.7.10-6ubuntu3.13+esm27 | None known |
imagemagickUbuntu:Pro:16.04:LTS | All versions, plus listed versions 8:6.8.9.9-5ubuntu28:6.8.9.9-68:6.8.9.9-6build18:6.8.9.9-78:6.8.9.9-7ubuntu1 Show 45 moreShow less8:6.8.9.9-7ubuntu28:6.8.9.9-7ubuntu38:6.8.9.9-7ubuntu48:6.8.9.9-7ubuntu58:6.8.9.9-7ubuntu5.18:6.8.9.9-7ubuntu5.28:6.8.9.9-7ubuntu5.38:6.8.9.9-7ubuntu5.48:6.8.9.9-7ubuntu5.58:6.8.9.9-7ubuntu5.68:6.8.9.9-7ubuntu5.78:6.8.9.9-7ubuntu5.88:6.8.9.9-7ubuntu5.98:6.8.9.9-7ubuntu5.118:6.8.9.9-7ubuntu5.128:6.8.9.9-7ubuntu5.138:6.8.9.9-7ubuntu5.148:6.8.9.9-7ubuntu5.158:6.8.9.9-7ubuntu5.168:6.8.9.9-7ubuntu5.16+esm18:6.8.9.9-7ubuntu5.16+esm28:6.8.9.9-7ubuntu5.16+esm38:6.8.9.9-7ubuntu5.16+esm48:6.8.9.9-7ubuntu5.16+esm58:6.8.9.9-7ubuntu5.16+esm68:6.8.9.9-7ubuntu5.16+esm78:6.8.9.9-7ubuntu5.16+esm88:6.8.9.9-7ubuntu5.16+esm98:6.8.9.9-7ubuntu5.16+esm108:6.8.9.9-7ubuntu5.16+esm118:6.8.9.9-7ubuntu5.16+esm128:6.8.9.9-7ubuntu5.16+esm138:6.8.9.9-7ubuntu5.16+esm148:6.8.9.9-7ubuntu5.16+esm158:6.8.9.9-7ubuntu5.16+esm168:6.8.9.9-7ubuntu5.16+esm178:6.8.9.9-7ubuntu5.16+esm188:6.8.9.9-7ubuntu5.16+esm198:6.8.9.9-7ubuntu5.16+esm208:6.8.9.9-7ubuntu5.16+esm218:6.8.9.9-7ubuntu5.16+esm228:6.8.9.9-7ubuntu5.16+esm238:6.8.9.9-7ubuntu5.16+esm248:6.8.9.9-7ubuntu5.16+esm258:6.8.9.9-7ubuntu5.16+esm26 | None known |
imagemagickUbuntu:Pro:18.04:LTS | All versions, plus listed versions 8:6.9.7.4+dfsg-16ubuntu28:6.9.7.4+dfsg-16ubuntu38:6.9.7.4+dfsg-16ubuntu48:6.9.7.4+dfsg-16ubuntu58:6.9.7.4+dfsg-16ubuntu6 Show 29 moreShow less8:6.9.7.4+dfsg-16ubuntu6.28:6.9.7.4+dfsg-16ubuntu6.38:6.9.7.4+dfsg-16ubuntu6.48:6.9.7.4+dfsg-16ubuntu6.78:6.9.7.4+dfsg-16ubuntu6.88:6.9.7.4+dfsg-16ubuntu6.98:6.9.7.4+dfsg-16ubuntu6.118:6.9.7.4+dfsg-16ubuntu6.128:6.9.7.4+dfsg-16ubuntu6.138:6.9.7.4+dfsg-16ubuntu6.148:6.9.7.4+dfsg-16ubuntu6.158:6.9.7.4+dfsg-16ubuntu6.15+esm18:6.9.7.4+dfsg-16ubuntu6.15+esm28:6.9.7.4+dfsg-16ubuntu6.15+esm38:6.9.7.4+dfsg-16ubuntu6.15+esm48:6.9.7.4+dfsg-16ubuntu6.15+esm58:6.9.7.4+dfsg-16ubuntu6.15+esm68:6.9.7.4+dfsg-16ubuntu6.15+esm78:6.9.7.4+dfsg-16ubuntu6.15+esm88:6.9.7.4+dfsg-16ubuntu6.15+esm98:6.9.7.4+dfsg-16ubuntu6.15+esm108:6.9.7.4+dfsg-16ubuntu6.15+esm118:6.9.7.4+dfsg-16ubuntu6.15+esm128:6.9.7.4+dfsg-16ubuntu6.15+esm138:6.9.7.4+dfsg-16ubuntu6.15+esm148:6.9.7.4+dfsg-16ubuntu6.15+esm158:6.9.7.4+dfsg-16ubuntu6.15+esm168:6.9.7.4+dfsg-16ubuntu6.15+esm178:6.9.7.4+dfsg-16ubuntu6.15+esm18 | None known |
imagemagickUbuntu:Pro:20.04:LTS | All versions, plus listed versions 8:6.9.10.23+dfsg-2.1ubuntu38:6.9.10.23+dfsg-2.1ubuntu88:6.9.10.23+dfsg-2.1ubuntu98:6.9.10.23+dfsg-2.1ubuntu108:6.9.10.23+dfsg-2.1ubuntu11 Show 31 moreShow less8:6.9.10.23+dfsg-2.1ubuntu11.18:6.9.10.23+dfsg-2.1ubuntu11.28:6.9.10.23+dfsg-2.1ubuntu11.48:6.9.10.23+dfsg-2.1ubuntu11.4+esm18:6.9.10.23+dfsg-2.1ubuntu11.58:6.9.10.23+dfsg-2.1ubuntu11.68:6.9.10.23+dfsg-2.1ubuntu11.6+esm18:6.9.10.23+dfsg-2.1ubuntu11.78:6.9.10.23+dfsg-2.1ubuntu11.7+esm18:6.9.10.23+dfsg-2.1ubuntu11.98:6.9.10.23+dfsg-2.1ubuntu11.9+esm18:6.9.10.23+dfsg-2.1ubuntu11.9+esm28:6.9.10.23+dfsg-2.1ubuntu11.108:6.9.10.23+dfsg-2.1ubuntu11.10+esm18:6.9.10.23+dfsg-2.1ubuntu11.118:6.9.10.23+dfsg-2.1ubuntu11.11+esm18:6.9.10.23+dfsg-2.1ubuntu11.11+esm28:6.9.10.23+dfsg-2.1ubuntu11.11+esm38:6.9.10.23+dfsg-2.1ubuntu11.11+esm48:6.9.10.23+dfsg-2.1ubuntu11.11+esm58:6.9.10.23+dfsg-2.1ubuntu11.11+esm68:6.9.10.23+dfsg-2.1ubuntu11.11+esm78:6.9.10.23+dfsg-2.1ubuntu11.11+esm88:6.9.10.23+dfsg-2.1ubuntu11.11+esm98:6.9.10.23+dfsg-2.1ubuntu11.11+esm108:6.9.10.23+dfsg-2.1ubuntu11.11+esm118:6.9.10.23+dfsg-2.1ubuntu11.11+esm128:6.9.10.23+dfsg-2.1ubuntu11.11+esm138:6.9.10.23+dfsg-2.1ubuntu11.11+esm148:6.9.10.23+dfsg-2.1ubuntu11.11+esm158:6.9.10.23+dfsg-2.1ubuntu11.11+esm16 | None known |
imagemagickUbuntu:Pro:22.04:LTS | All versions, plus listed versions 8:6.9.11.60+dfsg-1ubuntu18:6.9.11.60+dfsg-1.38:6.9.11.60+dfsg-1.3build18:6.9.11.60+dfsg-1.3build28:6.9.11.60+dfsg-1.3ubuntu0.22.04.1 Show 24 moreShow less8:6.9.11.60+dfsg-1.3ubuntu0.22.04.1+esm18:6.9.11.60+dfsg-1.3ubuntu0.22.04.28:6.9.11.60+dfsg-1.3ubuntu0.22.04.2+esm18:6.9.11.60+dfsg-1.3ubuntu0.22.04.38:6.9.11.60+dfsg-1.3ubuntu0.22.04.3+esm18:6.9.11.60+dfsg-1.3ubuntu0.22.04.3+esm28:6.9.11.60+dfsg-1.3ubuntu0.22.04.3+esm38:6.9.11.60+dfsg-1.3ubuntu0.22.04.58:6.9.11.60+dfsg-1.3ubuntu0.22.04.5+esm18:6.9.11.60+dfsg-1.3ubuntu0.22.04.5+esm28:6.9.11.60+dfsg-1.3ubuntu0.22.04.5+esm38:6.9.11.60+dfsg-1.3ubuntu0.22.04.5+esm48:6.9.11.60+dfsg-1.3ubuntu0.22.04.5+esm58:6.9.11.60+dfsg-1.3ubuntu0.22.04.5+esm68:6.9.11.60+dfsg-1.3ubuntu0.22.04.5+esm78:6.9.11.60+dfsg-1.3ubuntu0.22.04.5+esm88:6.9.11.60+dfsg-1.3ubuntu0.22.04.5+esm98:6.9.11.60+dfsg-1.3ubuntu0.22.04.5+esm108:6.9.11.60+dfsg-1.3ubuntu0.22.04.5+esm118:6.9.11.60+dfsg-1.3ubuntu0.22.04.5+esm128:6.9.11.60+dfsg-1.3ubuntu0.22.04.5+esm138:6.9.11.60+dfsg-1.3ubuntu0.22.04.5+esm148:6.9.11.60+dfsg-1.3ubuntu0.22.04.5+esm158:6.9.11.60+dfsg-1.3ubuntu0.22.04.5+esm16 | None known |
imagemagickUbuntu:Pro:24.04:LTS | All versions, plus listed versions 8:6.9.11.60+dfsg-1.6ubuntu18:6.9.12.98+dfsg1-58:6.9.12.98+dfsg1-5.2build18:6.9.12.98+dfsg1-5.2build28:6.9.12.98+dfsg1-5.2ubuntu0.1~esm1 Show 14 moreShow less8:6.9.12.98+dfsg1-5.2ubuntu0.1~esm28:6.9.12.98+dfsg1-5.2ubuntu0.1~esm38:6.9.12.98+dfsg1-5.2ubuntu0.1~esm48:6.9.12.98+dfsg1-5.2ubuntu0.1~esm58:6.9.12.98+dfsg1-5.2ubuntu0.1~esm68:6.9.12.98+dfsg1-5.2ubuntu0.1~esm78:6.9.12.98+dfsg1-5.2ubuntu0.1~esm88:6.9.12.98+dfsg1-5.2ubuntu0.1~esm98:6.9.12.98+dfsg1-5.2ubuntu0.1~esm108:6.9.12.98+dfsg1-5.2ubuntu0.1~esm118:6.9.12.98+dfsg1-5.2ubuntu0.1~esm128:6.9.12.98+dfsg1-5.2ubuntu0.1~esm138:6.9.12.98+dfsg1-5.2ubuntu0.1~esm148:6.9.12.98+dfsg1-5.2ubuntu0.1~esm15 | None known |
imagemagickUbuntu:26.10 | All versions, plus listed versions 8:7.1.2.18+dfsg1-18:7.1.2.25+dfsg1-28:7.1.2.27+dfsg1-18:7.1.2.31+dfsg1-1 | None known |
imagemagickUbuntu:Pro:26.04:LTS | All versions, plus listed versions 8:7.1.2.3+dfsg1-18:7.1.2.8+dfsg1-18:7.1.2.12+dfsg1-18:7.1.2.13+dfsg1-18:7.1.2.15+dfsg1-1 Show 6 moreShow less8:7.1.2.16+dfsg1-18:7.1.2.18+dfsg1-18:7.1.2.18+dfsg1-1ubuntu0.1~esm18:7.1.2.18+dfsg1-1ubuntu0.1~esm28:7.1.2.18+dfsg1-1ubuntu0.1~esm38:7.1.2.18+dfsg1-1ubuntu0.1~esm4 | None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-86422 is a low vulnerability (CVSS 1.0) in Imagemagick, published September 7, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.13%, the 2nd percentile. No source names a fixed version.
References
github.com/ImageMagick/ImageMagick/security/advisories/GHSA-x8g2-7r3w-h44p
vulncheck.com/advisories/imagemagick-before-7.1.2-30-path-policy-toctou-symlink-race
nvd.nist.gov/vuln/detail/CVE-2026-86422
ubuntu.com/security/CVE-2026-86422
cve.org/CVERecord?id=CVE-2026-86422