{"id":"CVE-2026-86424","aliases":["CLSA-2026-1791911076","CLSA-2026-1791913022","DEBIAN-CVE-2026-86424","EUVD-2026-72382","GHSA-9x6f-98x9-rx6g","GHSA-v7f7-cw7c-4cvq","MGASA-2026-0414","OESA-2026-3851","UBUNTU-CVE-2026-86424","openSUSE-SU-2026:11801-1"],"status":"published","title":"ImageMagick before 7.1.2-30 Path Traversal via TOCTOU Symlink Race","description":"ImageMagick before 7.1.2-30 and 6.9.13-55 contains a time-of-check-time-of-use (TOCTOU) vulnerability in the video decoder that allows attackers to bypass path policy write restrictions via symlink swaps. An attacker can replace a symlink between policy validation (check-time) and the file write operation (use-time) to write to policy-denied locations.","severity":{"version":"4.0","score":2,"vector":"CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N","level":"low","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00141,"percentile":0.03459,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-59"],"published":"2026-09-07T12:53:46Z","modified":"2026-10-31T02:30:47Z","fixes":[{"ecosystem":"Debian:12","package":"imagemagick","fixed_in":["8:6.9.11.60+dfsg-1.6+deb12u14"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"imagemagick","fixed_in":["8:7.1.1.43+dfsg1-1+deb13u13"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"imagemagick","fixed_in":["8:7.1.2.31+dfsg1-1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"ImageMagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.9.13.52-2.el9_2.tuxcare.els6"}]}],"bundled":4},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"ImageMagick-c++","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.9.13.52-2.el9_2.tuxcare.els6"}]}],"bundled":4},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"ImageMagick-c++-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.9.13.52-2.el9_2.tuxcare.els6"}]}],"bundled":4},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"ImageMagick-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.9.13.52-2.el9_2.tuxcare.els6"}]}],"bundled":4},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"ImageMagick-djvu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.9.13.52-2.el9_2.tuxcare.els6"}]}],"bundled":4},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"ImageMagick-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.9.13.52-2.el9_2.tuxcare.els6"}]}],"bundled":4},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"ImageMagick-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.9.13.52-2.el9_2.tuxcare.els6"}]}],"bundled":4},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"ImageMagick-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.9.13.52-2.el9_2.tuxcare.els6"}]}],"bundled":4},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"ImageMagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.9.13.52-2.el9_6.tuxcare.els6"}]}],"bundled":4},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"ImageMagick-c++","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.9.13.52-2.el9_6.tuxcare.els6"}]}],"bundled":4},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"ImageMagick-c++-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.9.13.52-2.el9_6.tuxcare.els6"}]}],"bundled":4},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"ImageMagick-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.9.13.52-2.el9_6.tuxcare.els6"}]}],"bundled":4},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"ImageMagick-djvu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.9.13.52-2.el9_6.tuxcare.els6"}]}],"bundled":4},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"ImageMagick-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.9.13.52-2.el9_6.tuxcare.els6"}]}],"bundled":4},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"ImageMagick-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.9.13.52-2.el9_6.tuxcare.els6"}]}],"bundled":4},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"ImageMagick-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.9.13.52-2.el9_6.tuxcare.els6"}]}],"bundled":4},{"source":"osv","ecosystem":"Debian:12","package":"imagemagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8:6.9.11.60+dfsg-1.6+deb12u14"}]}],"versions":["8:6.9.11.60+dfsg-1.6","8:6.9.11.60+dfsg-1.6+deb12u1","8:6.9.11.60+dfsg-1.6+deb12u10","8:6.9.11.60+dfsg-1.6+deb12u11","8:6.9.11.60+dfsg-1.6+deb12u12","8:6.9.11.60+dfsg-1.6+deb12u13","8:6.9.11.60+dfsg-1.6+deb12u2","8:6.9.11.60+dfsg-1.6+deb12u3","8:6.9.11.60+dfsg-1.6+deb12u4","8:6.9.11.60+dfsg-1.6+deb12u5","8:6.9.11.60+dfsg-1.6+deb12u6","8:6.9.11.60+dfsg-1.6+deb12u7","8:6.9.11.60+dfsg-1.6+deb12u8","8:6.9.11.60+dfsg-1.6+deb12u9"]},{"source":"osv","ecosystem":"Debian:13","package":"imagemagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8:7.1.1.43+dfsg1-1+deb13u13"}]}],"versions":["8:7.1.1.43+dfsg1-1","8:7.1.1.43+dfsg1-1+deb13u1","8:7.1.1.43+dfsg1-1+deb13u10","8:7.1.1.43+dfsg1-1+deb13u11","8:7.1.1.43+dfsg1-1+deb13u12","8:7.1.1.43+dfsg1-1+deb13u2","8:7.1.1.43+dfsg1-1+deb13u3","8:7.1.1.43+dfsg1-1+deb13u4","8:7.1.1.43+dfsg1-1+deb13u5","8:7.1.1.43+dfsg1-1+deb13u6","8:7.1.1.43+dfsg1-1+deb13u7","8:7.1.1.43+dfsg1-1+deb13u8","8:7.1.1.43+dfsg1-1+deb13u9"]},{"source":"osv","ecosystem":"Debian:14","package":"imagemagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8:7.1.2.31+dfsg1-1"}]}],"versions":["8:7.1.1.43+dfsg1-1","8:7.1.1.46+dfsg1-1","8:7.1.1.47+dfsg1-1","8:7.1.1.47+dfsg1-2","8:7.1.2.1+dfsg1-1","8:7.1.2.12+dfsg1-1","8:7.1.2.13+dfsg1-1","8:7.1.2.15+dfsg1-1","8:7.1.2.15+dfsg1-2","8:7.1.2.16+dfsg1-1","8:7.1.2.18+dfsg1-1","8:7.1.2.19+dfsg1-1","8:7.1.2.21+dfsg1-1","8:7.1.2.23+dfsg1-1","8:7.1.2.24+dfsg1-1","8:7.1.2.25+dfsg1-1","8:7.1.2.25+dfsg1-2","8:7.1.2.26+dfsg1-1","8:7.1.2.27+dfsg1-1","8:7.1.2.29+dfsg2-1","8:7.1.2.3+dfsg1-1","8:7.1.2.7+dfsg1-1","8:7.1.2.8+dfsg1-1"]},{"source":"osv","ecosystem":"Mageia:10","package":"imagemagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.1.2.31-1.mga10"}]}],"bundled":5},{"source":"osv","ecosystem":"Mageia:10","package":"imagemagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.1.2.31-1.mga10.tainted"}]}],"bundled":5},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP1","package":"ImageMagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.1.2.31-1.oe2403sp1"}]}],"bundled":5},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP3","package":"ImageMagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.1.2.31-1.oe2403sp3"}]}],"bundled":5},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP4","package":"ImageMagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.1.2.31-1.oe2403sp4"}]}],"bundled":5},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP4","package":"ImageMagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.9.13.56-1.oe2003sp4"}]}],"bundled":5},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP4","package":"ImageMagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.1.2.31-1.oe2203sp4"}]}],"bundled":5},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"imagemagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["8:6.7.7.10-5ubuntu3","8:6.7.7.10-5ubuntu4","8:6.7.7.10-6ubuntu1","8:6.7.7.10-6ubuntu2","8:6.7.7.10-6ubuntu3","8:6.7.7.10-6ubuntu3.1","8:6.7.7.10-6ubuntu3.2","8:6.7.7.10-6ubuntu3.3","8:6.7.7.10-6ubuntu3.4","8:6.7.7.10-6ubuntu3.5","8:6.7.7.10-6ubuntu3.6","8:6.7.7.10-6ubuntu3.7","8:6.7.7.10-6ubuntu3.8","8:6.7.7.10-6ubuntu3.9","8:6.7.7.10-6ubuntu3.11","8:6.7.7.10-6ubuntu3.12","8:6.7.7.10-6ubuntu3.13","8:6.7.7.10-6ubuntu3.13+esm1","8:6.7.7.10-6ubuntu3.13+esm2","8:6.7.7.10-6ubuntu3.13+esm3","8:6.7.7.10-6ubuntu3.13+esm4","8:6.7.7.10-6ubuntu3.13+esm5","8:6.7.7.10-6ubuntu3.13+esm6","8:6.7.7.10-6ubuntu3.13+esm7","8:6.7.7.10-6ubuntu3.13+esm8","8:6.7.7.10-6ubuntu3.13+esm9","8:6.7.7.10-6ubuntu3.13+esm10","8:6.7.7.10-6ubuntu3.13+esm11","8:6.7.7.10-6ubuntu3.13+esm12","8:6.7.7.10-6ubuntu3.13+esm13","8:6.7.7.10-6ubuntu3.13+esm14","8:6.7.7.10-6ubuntu3.13+esm15","8:6.7.7.10-6ubuntu3.13+esm16","8:6.7.7.10-6ubuntu3.13+esm17","8:6.7.7.10-6ubuntu3.13+esm18","8:6.7.7.10-6ubuntu3.13+esm19","8:6.7.7.10-6ubuntu3.13+esm20","8:6.7.7.10-6ubuntu3.13+esm21","8:6.7.7.10-6ubuntu3.13+esm22","8:6.7.7.10-6ubuntu3.13+esm23","8:6.7.7.10-6ubuntu3.13+esm24","8:6.7.7.10-6ubuntu3.13+esm25","8:6.7.7.10-6ubuntu3.13+esm26","8:6.7.7.10-6ubuntu3.13+esm27"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"imagemagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["8:6.8.9.9-5ubuntu2","8:6.8.9.9-6","8:6.8.9.9-6build1","8:6.8.9.9-7","8:6.8.9.9-7ubuntu1","8:6.8.9.9-7ubuntu2","8:6.8.9.9-7ubuntu3","8:6.8.9.9-7ubuntu4","8:6.8.9.9-7ubuntu5","8:6.8.9.9-7ubuntu5.1","8:6.8.9.9-7ubuntu5.2","8:6.8.9.9-7ubuntu5.3","8:6.8.9.9-7ubuntu5.4","8:6.8.9.9-7ubuntu5.5","8:6.8.9.9-7ubuntu5.6","8:6.8.9.9-7ubuntu5.7","8:6.8.9.9-7ubuntu5.8","8:6.8.9.9-7ubuntu5.9","8:6.8.9.9-7ubuntu5.11","8:6.8.9.9-7ubuntu5.12","8:6.8.9.9-7ubuntu5.13","8:6.8.9.9-7ubuntu5.14","8:6.8.9.9-7ubuntu5.15","8:6.8.9.9-7ubuntu5.16","8:6.8.9.9-7ubuntu5.16+esm1","8:6.8.9.9-7ubuntu5.16+esm2","8:6.8.9.9-7ubuntu5.16+esm3","8:6.8.9.9-7ubuntu5.16+esm4","8:6.8.9.9-7ubuntu5.16+esm5","8:6.8.9.9-7ubuntu5.16+esm6","8:6.8.9.9-7ubuntu5.16+esm7","8:6.8.9.9-7ubuntu5.16+esm8","8:6.8.9.9-7ubuntu5.16+esm9","8:6.8.9.9-7ubuntu5.16+esm10","8:6.8.9.9-7ubuntu5.16+esm11","8:6.8.9.9-7ubuntu5.16+esm12","8:6.8.9.9-7ubuntu5.16+esm13","8:6.8.9.9-7ubuntu5.16+esm14","8:6.8.9.9-7ubuntu5.16+esm15","8:6.8.9.9-7ubuntu5.16+esm16","8:6.8.9.9-7ubuntu5.16+esm17","8:6.8.9.9-7ubuntu5.16+esm18","8:6.8.9.9-7ubuntu5.16+esm19","8:6.8.9.9-7ubuntu5.16+esm20","8:6.8.9.9-7ubuntu5.16+esm21","8:6.8.9.9-7ubuntu5.16+esm22","8:6.8.9.9-7ubuntu5.16+esm23","8:6.8.9.9-7ubuntu5.16+esm24","8:6.8.9.9-7ubuntu5.16+esm25","8:6.8.9.9-7ubuntu5.16+esm26"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"imagemagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["8:6.9.7.4+dfsg-16ubuntu2","8:6.9.7.4+dfsg-16ubuntu3","8:6.9.7.4+dfsg-16ubuntu4","8:6.9.7.4+dfsg-16ubuntu5","8:6.9.7.4+dfsg-16ubuntu6","8:6.9.7.4+dfsg-16ubuntu6.2","8:6.9.7.4+dfsg-16ubuntu6.3","8:6.9.7.4+dfsg-16ubuntu6.4","8:6.9.7.4+dfsg-16ubuntu6.7","8:6.9.7.4+dfsg-16ubuntu6.8","8:6.9.7.4+dfsg-16ubuntu6.9","8:6.9.7.4+dfsg-16ubuntu6.11","8:6.9.7.4+dfsg-16ubuntu6.12","8:6.9.7.4+dfsg-16ubuntu6.13","8:6.9.7.4+dfsg-16ubuntu6.14","8:6.9.7.4+dfsg-16ubuntu6.15","8:6.9.7.4+dfsg-16ubuntu6.15+esm1","8:6.9.7.4+dfsg-16ubuntu6.15+esm2","8:6.9.7.4+dfsg-16ubuntu6.15+esm3","8:6.9.7.4+dfsg-16ubuntu6.15+esm4","8:6.9.7.4+dfsg-16ubuntu6.15+esm5","8:6.9.7.4+dfsg-16ubuntu6.15+esm6","8:6.9.7.4+dfsg-16ubuntu6.15+esm7","8:6.9.7.4+dfsg-16ubuntu6.15+esm8","8:6.9.7.4+dfsg-16ubuntu6.15+esm9","8:6.9.7.4+dfsg-16ubuntu6.15+esm10","8:6.9.7.4+dfsg-16ubuntu6.15+esm11","8:6.9.7.4+dfsg-16ubuntu6.15+esm12","8:6.9.7.4+dfsg-16ubuntu6.15+esm13","8:6.9.7.4+dfsg-16ubuntu6.15+esm14","8:6.9.7.4+dfsg-16ubuntu6.15+esm15","8:6.9.7.4+dfsg-16ubuntu6.15+esm16","8:6.9.7.4+dfsg-16ubuntu6.15+esm17","8:6.9.7.4+dfsg-16ubuntu6.15+esm18"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"imagemagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["8:6.9.10.23+dfsg-2.1ubuntu3","8:6.9.10.23+dfsg-2.1ubuntu8","8:6.9.10.23+dfsg-2.1ubuntu9","8:6.9.10.23+dfsg-2.1ubuntu10","8:6.9.10.23+dfsg-2.1ubuntu11","8:6.9.10.23+dfsg-2.1ubuntu11.1","8:6.9.10.23+dfsg-2.1ubuntu11.2","8:6.9.10.23+dfsg-2.1ubuntu11.4","8:6.9.10.23+dfsg-2.1ubuntu11.4+esm1","8:6.9.10.23+dfsg-2.1ubuntu11.5","8:6.9.10.23+dfsg-2.1ubuntu11.6","8:6.9.10.23+dfsg-2.1ubuntu11.6+esm1","8:6.9.10.23+dfsg-2.1ubuntu11.7","8:6.9.10.23+dfsg-2.1ubuntu11.7+esm1","8:6.9.10.23+dfsg-2.1ubuntu11.9","8:6.9.10.23+dfsg-2.1ubuntu11.9+esm1","8:6.9.10.23+dfsg-2.1ubuntu11.9+esm2","8:6.9.10.23+dfsg-2.1ubuntu11.10","8:6.9.10.23+dfsg-2.1ubuntu11.10+esm1","8:6.9.10.23+dfsg-2.1ubuntu11.11","8:6.9.10.23+dfsg-2.1ubuntu11.11+esm1","8:6.9.10.23+dfsg-2.1ubuntu11.11+esm2","8:6.9.10.23+dfsg-2.1ubuntu11.11+esm3","8:6.9.10.23+dfsg-2.1ubuntu11.11+esm4","8:6.9.10.23+dfsg-2.1ubuntu11.11+esm5","8:6.9.10.23+dfsg-2.1ubuntu11.11+esm6","8:6.9.10.23+dfsg-2.1ubuntu11.11+esm7","8:6.9.10.23+dfsg-2.1ubuntu11.11+esm8","8:6.9.10.23+dfsg-2.1ubuntu11.11+esm9","8:6.9.10.23+dfsg-2.1ubuntu11.11+esm10","8:6.9.10.23+dfsg-2.1ubuntu11.11+esm11","8:6.9.10.23+dfsg-2.1ubuntu11.11+esm12","8:6.9.10.23+dfsg-2.1ubuntu11.11+esm13","8:6.9.10.23+dfsg-2.1ubuntu11.11+esm14","8:6.9.10.23+dfsg-2.1ubuntu11.11+esm15","8:6.9.10.23+dfsg-2.1ubuntu11.11+esm16"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"imagemagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["8:6.9.11.60+dfsg-1ubuntu1","8:6.9.11.60+dfsg-1.3","8:6.9.11.60+dfsg-1.3build1","8:6.9.11.60+dfsg-1.3build2","8:6.9.11.60+dfsg-1.3ubuntu0.22.04.1","8:6.9.11.60+dfsg-1.3ubuntu0.22.04.1+esm1","8:6.9.11.60+dfsg-1.3ubuntu0.22.04.2","8:6.9.11.60+dfsg-1.3ubuntu0.22.04.2+esm1","8:6.9.11.60+dfsg-1.3ubuntu0.22.04.3","8:6.9.11.60+dfsg-1.3ubuntu0.22.04.3+esm1","8:6.9.11.60+dfsg-1.3ubuntu0.22.04.3+esm2","8:6.9.11.60+dfsg-1.3ubuntu0.22.04.3+esm3","8:6.9.11.60+dfsg-1.3ubuntu0.22.04.5","8:6.9.11.60+dfsg-1.3ubuntu0.22.04.5+esm1","8:6.9.11.60+dfsg-1.3ubuntu0.22.04.5+esm2","8:6.9.11.60+dfsg-1.3ubuntu0.22.04.5+esm3","8:6.9.11.60+dfsg-1.3ubuntu0.22.04.5+esm4","8:6.9.11.60+dfsg-1.3ubuntu0.22.04.5+esm5","8:6.9.11.60+dfsg-1.3ubuntu0.22.04.5+esm6","8:6.9.11.60+dfsg-1.3ubuntu0.22.04.5+esm7","8:6.9.11.60+dfsg-1.3ubuntu0.22.04.5+esm8","8:6.9.11.60+dfsg-1.3ubuntu0.22.04.5+esm9","8:6.9.11.60+dfsg-1.3ubuntu0.22.04.5+esm10","8:6.9.11.60+dfsg-1.3ubuntu0.22.04.5+esm11","8:6.9.11.60+dfsg-1.3ubuntu0.22.04.5+esm12","8:6.9.11.60+dfsg-1.3ubuntu0.22.04.5+esm13","8:6.9.11.60+dfsg-1.3ubuntu0.22.04.5+esm14","8:6.9.11.60+dfsg-1.3ubuntu0.22.04.5+esm15","8:6.9.11.60+dfsg-1.3ubuntu0.22.04.5+esm16"]},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"imagemagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["8:6.9.11.60+dfsg-1.6ubuntu1","8:6.9.12.98+dfsg1-5","8:6.9.12.98+dfsg1-5.2build1","8:6.9.12.98+dfsg1-5.2build2","8:6.9.12.98+dfsg1-5.2ubuntu0.1~esm1","8:6.9.12.98+dfsg1-5.2ubuntu0.1~esm2","8:6.9.12.98+dfsg1-5.2ubuntu0.1~esm3","8:6.9.12.98+dfsg1-5.2ubuntu0.1~esm4","8:6.9.12.98+dfsg1-5.2ubuntu0.1~esm5","8:6.9.12.98+dfsg1-5.2ubuntu0.1~esm6","8:6.9.12.98+dfsg1-5.2ubuntu0.1~esm7","8:6.9.12.98+dfsg1-5.2ubuntu0.1~esm8","8:6.9.12.98+dfsg1-5.2ubuntu0.1~esm9","8:6.9.12.98+dfsg1-5.2ubuntu0.1~esm10","8:6.9.12.98+dfsg1-5.2ubuntu0.1~esm11","8:6.9.12.98+dfsg1-5.2ubuntu0.1~esm12","8:6.9.12.98+dfsg1-5.2ubuntu0.1~esm13","8:6.9.12.98+dfsg1-5.2ubuntu0.1~esm14","8:6.9.12.98+dfsg1-5.2ubuntu0.1~esm15"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"imagemagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["8:7.1.2.18+dfsg1-1","8:7.1.2.25+dfsg1-2","8:7.1.2.27+dfsg1-1","8:7.1.2.31+dfsg1-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:26.04:LTS","package":"imagemagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["8:7.1.2.3+dfsg1-1","8:7.1.2.8+dfsg1-1","8:7.1.2.12+dfsg1-1","8:7.1.2.13+dfsg1-1","8:7.1.2.15+dfsg1-1","8:7.1.2.16+dfsg1-1","8:7.1.2.18+dfsg1-1","8:7.1.2.18+dfsg1-1ubuntu0.1~esm1","8:7.1.2.18+dfsg1-1ubuntu0.1~esm2","8:7.1.2.18+dfsg1-1ubuntu0.1~esm3","8:7.1.2.18+dfsg1-1ubuntu0.1~esm4"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"ImageMagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.1.2.31-1.1"}]}],"bundled":5}],"products":[{"vendor":"imagemagick","product":"imagemagick"}],"references":[{"url":"https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-9x6f-98x9-rx6g","tags":["vendor-advisory","Vendor Advisory","advisory","report"]},{"url":"https://www.vulncheck.com/advisories/imagemagick-before-7.1.2-30-path-traversal-via-toctou-symlink-race","tags":["third-party-advisory","Third Party Advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-86424","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-v7f7-cw7c-4cvq"},{"url":"https://errata.tuxcare.com/els_os/almalinux9.2esu/CLSA-2026-1791911076.html","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-34238","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-86423","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-86425","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/tuxcare9.6esu/CLSA-2026-1791913022.html","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/86xxx/CVE-2026-86424.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-86424","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2026-0414.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=36167","tags":["report"]},{"url":"https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-chf5-8rv9-gjqr","tags":["advisory"]},{"url":"https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-5m9j-96ff-j6qc","tags":["advisory"]},{"url":"https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-4jv7-q6xw-6f4x","tags":["advisory"]},{"url":"https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-4mwf-mggw-29vp","tags":["advisory"]},{"url":"https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-7hjx-392p-f8cm","tags":["advisory"]},{"url":"https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-4gg2-hfgh-6f5c","tags":["advisory"]},{"url":"https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-92rw-c5mw-27v4","tags":["advisory"]},{"url":"https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-89wq-f8f6-2j2v","tags":["advisory"]},{"url":"https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-3rjr-534c-8v67","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3851","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-86420","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-86421","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-86424","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-86424","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2026-86420","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-86421","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-86423","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-86424","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-86425","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2026-86424","title":"ImageMagick before 7.1.2-30 Path Traversal via TOCTOU Symlink Race","description":"ImageMagick before 7.1.2-30 and 6.9.13-55 contains a time-of-check-time-of-use (TOCTOU) vulnerability in the video decoder that allows attackers to bypass path policy write restrictions via symlink swaps. An attacker can replace a symlink between policy validation (check-time) and the file write operation (use-time) to write to policy-denied locations.","status":"published","published":"2026-09-07T12:53:46.565Z","modified":"2026-10-29T21:17:06.488Z","cvss":[{"version":"4.0","score":2,"vector":"CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N","level":"low","assessor":"cna"},{"version":"3.1","score":2.5,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N","level":"low","assessor":"cna"}],"cwes":["CWE-59"],"updated_at":"2026-11-02T13:49:31.546614Z"}],"euvd":[{"id":"EUVD-2026-72382","description":"ImageMagick before 7.1.2-30 and 6.9.13-55 contains a time-of-check-time-of-use (TOCTOU) vulnerability in the video decoder that allows attackers to bypass path policy write restrictions via symlink swaps. An attacker can replace a symlink between policy validation (check-time) and the file write operation (use-time) to write to policy-denied locations.","status":"published","published":"2026-09-07T12:53:46Z","modified":"2026-10-29T21:17:06Z","cvss":[{"version":"4.0","score":2,"vector":"CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N","level":"low"}],"updated_at":"2026-11-02T16:59:13.894662Z"}],"ghsa":[{"id":"GHSA-v7f7-cw7c-4cvq","title":"ImageMagick before 7.1.2-30 and 6.9.13-55 contains a time-of-check-time-of-use (TOCTOU)...","description":"ImageMagick before 7.1.2-30 and 6.9.13-55 contains a time-of-check-time-of-use (TOCTOU) vulnerability in the video decoder that allows attackers to bypass path policy write restrictions via symlink swaps. An attacker can replace a symlink between policy validation (check-time) and the file write operation (use-time) to write to policy-denied locations.","status":"published","published":"2026-09-07T15:33:52Z","modified":"2026-09-07T15:33:56Z","cvss":[{"version":"4.0","score":2,"vector":"CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"low"},{"version":"3.1","score":2.5,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N","level":"low"}],"cwes":["CWE-59"],"updated_at":"2026-11-02T15:11:27.182088Z"}],"nvd":[{"id":"CVE-2026-86424","description":"ImageMagick before 7.1.2-30 and 6.9.13-55 contains a time-of-check-time-of-use (TOCTOU) vulnerability in the video decoder that allows attackers to bypass path policy write restrictions via symlink swaps. An attacker can replace a symlink between policy validation (check-time) and the file write operation (use-time) to write to policy-denied locations.","status":"published","published":"2026-09-07T13:20:41.403Z","modified":"2026-10-29T21:17:35.42Z","cvss":[{"version":"4.0","score":2,"vector":"CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"low","assessor":"secondary"},{"version":"3.1","score":2.5,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N","level":"low","assessor":"secondary"}],"cwes":["CWE-59"],"updated_at":"2026-11-02T14:12:44.436435Z"}],"osv":[{"id":"CVE-2026-86424","title":"ImageMagick before 7.1.2-30 Path Traversal via TOCTOU Symlink Race","description":"ImageMagick before 7.1.2-30 and 6.9.13-55 contains a time-of-check-time-of-use (TOCTOU) vulnerability in the video decoder that allows attackers to bypass path policy write restrictions via symlink swaps. An attacker can replace a symlink between policy validation (check-time) and the file write operation (use-time) to write to policy-denied locations.","status":"published","published":"2026-09-07T12:53:46.565Z","modified":"2026-10-31T02:30:47.013775961Z","cvss":[{"version":"4.0","score":2,"vector":"CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N","level":"low"}],"cwes":["CWE-59"],"updated_at":"2026-11-02T15:45:18.825071Z"},{"id":"DEBIAN-CVE-2026-86424","description":"ImageMagick before 7.1.2-30 and 6.9.13-55 contains a time-of-check-time-of-use (TOCTOU) vulnerability in the video decoder that allows attackers to bypass path policy write restrictions via symlink swaps. An attacker can replace a symlink between policy validation (check-time) and the file write operation (use-time) to write to policy-denied locations.","status":"published","published":"2026-09-07T13:20:41.403Z","modified":"2026-10-30T09:49:20.487675536Z","cvss":[{"version":"4.0","score":2,"vector":"CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"low"}],"updated_at":"2026-11-02T15:46:05.022702Z"},{"id":"OESA-2026-3851","title":"ImageMagick security update","description":"Use ImageMagick to create, edit, compose, or convert bitmap images. It can read and write images in a variety of formats (over 200) including PNG, JPEG, GIF, HEIC, TIFF, DPX, EXR, WebP, Postscript, PDF, and SVG. Use ImageMagick to resize, flip, mirror, rotate, distort, shear and transform images, adjust image colors, apply various special effects, or draw text, lines, polygons, ellipses and Bézier curves.\r\n\r\nSecurity Fix(es):\n\nImageMagick before 7.1.2-30 and 6.9.13-55 fails to properly lower the memory budget when an operation inside OpenPixelCache fails. Repeated triggering of such failures can exhaust the process memory budget and result in a denial of service.(CVE-2026-86420)\n\nImageMagick before 7.1.2-30 and 6.9.13-55 contains a memory leak in the MSL image decoder. A crafted MSL image triggers memory allocation without proper deallocation, allowing an attacker to exhaust memory and cause a denial of service.(CVE-2026-86421)\n\nImageMagick before 7.1.2-30 and 6.9.x before 6.9.13-55 contains a heap-use-after-free vulnerability in the GetList method of PerlMagick. A crafted call to the GetList method can trigger the use-after-free, resulting in a crash (denial of service).(CVE-2026-86423)\n\nImageMagick before 7.1.2-30 and 6.9.13-55 contains a time-of-check-time-of-use (TOCTOU) vulnerability in the video decoder that allows attackers to bypass path policy write restrictions via symlink swaps. An attacker can replace a symlink between policy validation (check-time) and the file write operation (use-time) to write to policy-denied locations.(CVE-2026-86424)\n\nImageMagick before 7.1.2-30 and 6.9.x before 6.9.13-55 contains a heap-use-after-free vulnerability in the Layer method of PerlMagick. An attacker who supplies a crafted list of images can trigger memory access after deallocation, resulting in a crash (denial of service).(CVE-2026-86425)","status":"published","published":"2026-09-14T16:35:00Z","modified":"2026-09-13T16:45:51.156584615Z","cvss":[{"version":"4.0","score":6.3,"vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium"}],"updated_at":"2026-11-02T15:52:47.643553Z"},{"id":"UBUNTU-CVE-2026-86424","description":"ImageMagick before 7.1.2-30 and 6.9.13-55 contains a time-of-check-time-of-use (TOCTOU) vulnerability in the video decoder that allows attackers to bypass path policy write restrictions via symlink swaps. An attacker can replace a symlink between policy validation (check-time) and the file write operation (use-time) to write to policy-denied locations.","status":"published","published":"2026-09-07T13:20:00Z","modified":"2026-10-17T13:01:13.823390144Z","cvss":[{"version":"3.1","score":2.5,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N","level":"low"},{"version":"4.0","score":2,"vector":"CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N","level":"low"}],"updated_at":"2026-11-02T16:57:24.828975Z"},{"id":"CLSA-2026-1791911076","title":"ImageMagick: Fix of 4 CVEs","description":"- CVE-2026-86425: split a copy of the image list at the first NULL:\n  image in the PerlMagick Layers method to prevent a heap use-after-free\n- CVE-2026-86423: clone every image that appears more than once in a\n  PerlMagick image list, not only adjacent repeats, so the same image is\n  never linked into a list twice\n- CVE-2026-86424: open the delegate output file without following\n  symbolic links and check the write policy again after opening it, to\n  prevent a symlink race from bypassing the path policy\n- CVE-2026-34238: check the despeckle buffer size for integer overflow\n  to prevent a heap buffer overflow on 32-bit systems","status":"published","published":"2026-10-13T17:04:50Z","modified":"2026-10-26T09:43:36.269906081Z","updated_at":"2026-11-02T15:43:50.599064Z"},{"id":"CLSA-2026-1791913022","title":"ImageMagick: Fix of 4 CVEs","description":"- CVE-2026-86425: split a copy of the image list at the first NULL:\n  image in the PerlMagick Layers method to prevent a heap use-after-free\n- CVE-2026-86423: clone every image that appears more than once in a\n  PerlMagick image list, not only adjacent repeats, so the same image is\n  never linked into a list twice\n- CVE-2026-86424: open the delegate output file without following\n  symbolic links and check the write policy again after opening it, to\n  prevent a symlink race from bypassing the path policy\n- CVE-2026-34238: check the despeckle buffer size for integer overflow\n  to prevent a heap buffer overflow on 32-bit systems","status":"published","published":"2026-10-13T17:37:15Z","modified":"2026-10-26T09:43:41.515893741Z","updated_at":"2026-11-02T15:43:50.599064Z"},{"id":"MGASA-2026-0414","title":"Updated imagemagick package fixes security vulnerabilities","description":"Heap-use-after-free in Layer method of PerlMagick could result in a\ncrash\nPath Policy TOCTOU symlink race bypass in the video decoder\nHeap-use-after-free in the GetList method of PerlMagick could result in\na crash\nMemory Leak in MSL decoder\nDenial of service when exhausting the process memory budget\nPolicy Bypass in UHDR encoder\nDivision by Zero in FLIF encoder\nNull Pointer Dereference in PNM coder when hitting a memory limit\nPolicy Bypass in PCD, CUBE and HALD decoder when using a specific\ncommand line option.\nUse after free in ImagesToBlob method\n","status":"published","published":"2026-09-17T14:10:41Z","modified":"2026-09-17T14:15:02.574117436Z","updated_at":"2026-11-02T15:49:43.795591Z"},{"id":"openSUSE-SU-2026:11801-1","title":"ImageMagick-7.1.2.31-1.1 on GA media","description":"These are all security issues fixed in the ImageMagick-7.1.2.31-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-09-17T00:00:00Z","modified":"2026-09-18T18:23:08.619415239Z","updated_at":"2026-11-02T16:58:39.516824Z"}]}}