CVE-2026-28689: 
C# vulnerability analysis and mitigation

CVE-2026-28689 is a Time-of-Check to Time-of-Use (TOCTOU) symlink race condition vulnerability in ImageMagick, a widely used open-source image editing library. The flaw allows a local attacker to bypass path-based policy controls by swapping a symlink between the authorization check and the actual file open/use operation. It affects ImageMagick versions prior to 7.1.2-16 (7.x branch) and prior to 6.9.13-41 (6.9.x branch), as well as Magick.NET NuGet packages prior to version 14.10.4. Disclosed on March 9, 2026, it carries a CVSS v3.1 base score of 6.3 (Medium) (Github Advisory, Red Hat).

The vulnerability is classified under CWE-367 (Time-of-Check Time-of-Use Race Condition) and CWE-59 (Improper Link Resolution Before File Access / Link Following). ImageMagick's domain="path" policy authorization is evaluated against a file path before the file is actually opened or used; an attacker with local access can exploit the race window between these two operations by atomically replacing a permitted file path with a symlink pointing to a policy-restricted target. This technique — known as a symlink swap attack (CAPEC-27, CAPEC-132) — requires low privileges and no user interaction, but does require high attack complexity due to the timing constraints of the race condition (Github Advisory, Red Hat Bugzilla).

Successful exploitation allows a low-privileged local attacker to read files that ImageMagick's path policy is configured to deny (information disclosure) and to write or modify files outside the permitted scope (unauthorized modification). Both confidentiality and integrity impacts are rated High, while availability is unaffected. In environments where ImageMagick processes images with elevated privileges or in multi-tenant contexts, this could expose sensitive configuration files, credentials, or allow tampering with protected system files (Github Advisory, Red Hat).

1. Gain local access: Obtain a low-privilege shell on a system running a vulnerable version of ImageMagick (< 7.1.2-16 or < 6.9.13-41) where path-based policies restrict access to certain files.
2. Identify a policy-restricted target: Determine which file paths are blocked by ImageMagick's domain="path" policy (e.g., /etc/shadow or other sensitive files).
3. Prepare a permitted file: Create or identify a file path that passes ImageMagick's policy check (e.g., a writable file in an allowed directory).
4. Set up the symlink swap: Write a script or use a tool (e.g., a tight loop using ln -sf) to rapidly alternate the permitted file path between a normal file and a symlink pointing to the policy-restricted target.
5. Trigger ImageMagick processing: Invoke an ImageMagick command (e.g., convert) referencing the permitted file path, repeatedly or in parallel, to increase the probability of winning the race between the policy check and the actual file open.
6. Win the race: When the symlink swap occurs in the window between the policy authorization check and the file open syscall, ImageMagick opens the restricted target file instead, enabling unauthorized read or write access (Github Advisory, Red Hat Bugzilla).

• File System: Rapid creation and deletion of symlinks in directories accessible to the ImageMagick process; symlinks pointing from allowed paths to policy-restricted files (e.g., /etc/shadow, /etc/passwd, or sensitive config files).
• Process: High-frequency convert, magick, or related ImageMagick process invocations from low-privilege accounts; unusual child processes or file access patterns from ImageMagick processes.
• Logs: System audit logs (auditd) showing open() or stat() syscalls on policy-restricted files by the ImageMagick process; repeated lstat/open sequences on the same path in rapid succession.
• File System: Unexpected modification timestamps on sensitive files (e.g., /etc/shadow) coinciding with ImageMagick process activity.

Upgrade ImageMagick to version 7.1.2-16 or later (7.x branch) or 6.9.13-41 or later (6.9.x branch). For .NET users, update Magick.NET NuGet packages to version 14.10.4 or later. As interim mitigations: restrict local user access to systems running vulnerable ImageMagick versions, audit and tighten file system permissions to limit symlink creation in directories used by ImageMagick, and monitor for suspicious symlink activity. Linux distributions including Debian, SUSE, and Amazon Linux 2 have issued updated packages (Github Advisory, Red Hat).

The vulnerability was reported by researcher andsopwn and published by ImageMagick maintainer dlemstra on March 9, 2026. Red Hat tracked it via Bugzilla (Bug 2445891) and assigned it medium severity. Multiple Linux distributions (Debian, SUSE/openSUSE, Amazon Linux 2) issued security advisories and updated packages in the weeks following disclosure. Tenable released multiple Nessus detection plugins (IDs 301753, 302153, 304613, 305282, 305286, 305289, 307507, 309923) and Qualys added detection signatures as well, reflecting broad scanner coverage (Github Advisory, Red Hat Bugzilla).