CVE-2026-86424 in ImageMagick
Summary
by MITRE • 09/07/2026
ImageMagick before 7.1.2-30 and 6.9.13-55 contains a time-of-check-time-of-use (TOCTOU) vulnerability in the video decoder that allows attackers to bypass path policy write restrictions via symlink swaps. An attacker can replace a symlink between policy validation (check-time) and the file write operation (use-time) to write to policy-denied locations.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/07/2026
ImageMagick, a widely used open-source software suite for creating, editing, composing, or converting bitmap images, contains a critical time-of-check-then-use vulnerability within its video decoder component in versions prior to 7.1.2-30 and 6.9.13-55. This flaw stems from an insecure handling of file paths during the decoding process, specifically when writing output files or temporary data associated with video processing tasks. The core issue lies in the lack of atomicity between validating a file path against security policies and actually performing the write operation to that location. In many software systems, particularly those dealing with complex media formats like videos, it is common practice to validate input parameters such as filenames before proceeding with resource allocation or I/O operations. However, if there is any delay or opportunity for state change between these two steps, an attacker can exploit this race condition by manipulating the filesystem in real-time.
The technical mechanism of this vulnerability involves a symlink swap attack that exploits the gap between policy validation and file access. When ImageMagick processes a video file, it checks whether the target path complies with configured security policies designed to prevent writes to sensitive system directories or unauthorized locations. This check occurs at what is known as the time-of-check phase. If the path passes this initial inspection, the software proceeds to open the file for writing during the use-time phase. An attacker who has write access to a directory referenced by the application can create a symbolic link pointing to a restricted location, such as /etc/passwd or other critical system files. By carefully timing their actions, the attacker can replace this symlink with one pointing to an allowed path just before the policy check occurs, and then immediately swap it back to point at the restricted target after the check passes but before the actual write operation executes. This allows data to be written to locations that were explicitly denied by the security configuration.
This vulnerability maps directly to CWE-367, which describes time-of-check-time-of-use (TOCTOU) race conditions involving file systems. It also aligns with MITRE ATT&CK technique T1552.004, Unsecured Credentials: Private Keys, or more broadly T1083 File and Directory Discovery if used for reconnaissance, though the primary impact here is unauthorized write access which can lead to privilege escalation or system compromise depending on the context in which ImageMagick runs. The ability to bypass path policy restrictions means that an attacker could potentially overwrite critical configuration files, inject malicious scripts into web-accessible directories, or corrupt essential system binaries if the service has sufficient privileges. In environments where ImageMagick is used as part of a larger application stack, such as a web server processing uploaded images and videos, this vulnerability can be triggered remotely by supplying crafted video inputs that trigger the vulnerable code path in the decoder.
The operational impact of this flaw is significant because it undermines one of the primary defense mechanisms provided by ImageMagick's policy system. Administrators rely on these policies to sandbox image processing operations and prevent arbitrary file writes, which are common vectors for remote code execution or denial of service attacks. By bypassing these restrictions through a TOCTOU race condition, an attacker gains the ability to write files anywhere on the filesystem where they have symlink creation privileges. This can lead to data integrity issues, unauthorized access to sensitive information stored in overwritten files, and potentially full system compromise if critical executables or configuration files are targeted. The severity is further amplified by the fact that video processing often involves larger buffers and more complex parsing logic than simple image formats, increasing the window of opportunity for such race conditions to succeed.
Mitigation strategies primarily involve upgrading ImageMagick to version 7.1.2-30 or later, where this TOCTOU flaw has been addressed by ensuring atomic operations or stricter locking mechanisms during file path validation and access. Until an upgrade is feasible, administrators should consider restricting the privileges of the user account running the ImageMagick service to limit the potential damage from successful exploitation. Additionally, disabling video decoding capabilities if they are not required can reduce the attack surface. It is also advisable to review and harden filesystem permissions to prevent unauthorized users from creating symlinks in directories accessible by the application. Monitoring for unusual file write patterns or symlink creations in sensitive areas may help detect attempted exploits of this vulnerability in real-time, providing an additional layer of defense against such race condition attacks.