CVE-2026-109274 in ImageMagick
Summary
by MITRE • 10/12/2026
ImageMagick before 7.1.2-32 contains a time-of-check time-of-use symlink race vulnerability that allows attackers to bypass the path security policy when executing a magick script. Attackers can swap a checked path with a symlink during script execution to read files that the security policy is meant to block.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/12/2026
ImageMagick versions prior to 7.1.2-32 are susceptible to a critical time-of-check time-of-use vulnerability within its magick scripting engine, which fundamentally undermines the integrity of path-based security policies designed to restrict file access. This flaw arises from an inherent race condition where the application verifies that a target file resides within an allowed directory during the initial check phase but does not maintain atomicity between this verification and the subsequent actual read or write operation. During this narrow temporal window, an attacker with local filesystem privileges can manipulate the underlying path by replacing the expected regular file with a symbolic link pointing to a sensitive system location outside of the permitted scope. Because ImageMagick relies on static policy checks rather than dynamic resolution at the moment of I/O execution, it proceeds to process the symlinked target as if it were still within the authorized directory structure.
The operational impact of this vulnerability is severe, as it enables unauthorized access to arbitrary files on the host system that are otherwise protected by ImageMagick's security policies. By exploiting this race condition, an attacker can read sensitive configuration files, private keys, or other confidential data stored in restricted directories such as /etc/shadow or application-specific secret stores. This bypass mechanism effectively neutralizes one of the primary defense layers provided by ImageMagick against local privilege escalation and information disclosure attacks. The vulnerability is particularly dangerous because it does not require remote code execution capabilities; instead, it leverages standard filesystem operations that are often available to lower-privileged users in shared hosting or multi-user environments where image processing services run with elevated permissions relative to the user context.
From a classification perspective, this flaw aligns closely with CWE-367, which defines time-of-check time-of-use errors as security vulnerabilities caused by checking some property of an object and then using that object without verifying that the property has not changed since it was checked. In the context of MITRE ATT&CK techniques, this behavior corresponds to T1083 File and Directory Discovery, where adversaries explore local file systems for sensitive information, and potentially T1552 Unsecured Credentials if the accessed files contain authentication data or private keys. The exploitation vector typically involves crafting a malicious magick script that triggers multiple rapid filesystem operations, increasing the probability of successfully swapping the target path during execution.
Mitigation strategies must prioritize immediate software updates to version 7.1.2-32 or later, where this race condition has been addressed through improved atomicity checks and stricter validation mechanisms at the point of file access rather than solely at script parsing time. In environments where upgrading is not immediately feasible, administrators should enforce strict filesystem permissions that limit user ability to create symlinks in directories processed by ImageMagick, thereby reducing the attack surface for path swapping attacks. Additionally, running image processing services under dedicated service accounts with minimal privileges and utilizing containerization or sandboxing can further isolate potential impacts from successful exploitation attempts. Regular auditing of security policies and monitoring for unusual symlink creation patterns within application working directories provide additional layers of defense against this class of vulnerability.