Low severity3.3NVD Advisory· Published Sep 7, 2026· Updated Sep 10, 2026
CVE-2026-86422
CVE-2026-86422
Description
ImageMagick before 7.1.2-30 contains a time-of-check-time-of-use vulnerability in path policy enforcement on Windows that allows attackers to bypass read or write restrictions by exploiting symlink race conditions. Attackers can swap symlinks between policy validation and file access to read or write policy-denied files.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
2cpe:2.3:a:imagemagick:imagemagick:*:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:imagemagick:imagemagick:*:*:*:*:*:*:*:*range: <6.9.13-55
- (no CPE)range: <7.1.2-30
Patches
Vulnerability mechanics
References
2- github.com/ImageMagick/ImageMagick/security/advisories/GHSA-x8g2-7r3w-h44pnvdVendor Advisory
- www.vulncheck.com/advisories/imagemagick-before-7.1.2-30-path-policy-toctou-symlink-racenvdThird Party Advisory
News mentions
0No linked articles in our index yet.