CVE-2026-86422: 
ImageMagick vulnerability analysis and mitigation

CVE-2026-86422 is a time-of-check-time-of-use (TOCTOU) vulnerability in ImageMagick's path policy enforcement on Windows that allows local attackers to bypass read or write restrictions via symlink race conditions. Affected versions include ImageMagick before 7.1.2-30 (7.x branch) and before 6.9.13-55 (6.x branch). The vulnerability was published on September 7, 2026, with the security advisory originally authored by dlemstra and reported by gb1dev. It carries a CVSS v3.1 base score of 3.3 (Low) and a CVSS v4.0 base score of 1.0 (Low) (GitHub Advisory, GitHub Advisory DB).

The root cause is CWE-59 (Improper Link Resolution Before File Access / 'Link Following'), a classic TOCTOU race condition in ImageMagick's path policy enforcement logic on Windows. During policy validation, ImageMagick checks whether a file path is permitted under its configured access policy; however, an attacker can swap a symlink between the moment of policy validation (time-of-check) and the actual file access (time-of-use), causing ImageMagick to operate on a different file than the one that was validated. Exploitation requires local access with low privileges and some degree of user interaction or timing coordination to win the race window. No public proof-of-concept code has been identified (GitHub Advisory, GitHub Advisory DB).

Successful exploitation allows a low-privileged local attacker to read or write files that are explicitly denied by ImageMagick's path policy configuration, effectively bypassing a security control intended to restrict file access. The confidentiality and integrity impacts are both rated Low, and there is no availability impact, meaning an attacker could access or tamper with policy-restricted files but cannot cause a denial of service. The vulnerability is scoped to the local system and does not affect subsequent systems, limiting the blast radius to the host running the vulnerable ImageMagick version on Windows (GitHub Advisory, GitHub Advisory DB).

There is no known public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the disclosure date (GitHub Advisory DB). The EPSS score is 0.0, reflecting a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation is inherently constrained by the requirement for local access, low privileges, user interaction, and the need to win a timing-dependent race condition, all of which significantly reduce practical exploitability.

1. Gain local access: Obtain a low-privileged local account on a Windows system running a vulnerable version of ImageMagick (before 7.1.2-30 or 6.9.13-55).
2. Identify a policy-restricted path: Determine which file paths are denied by the target system's ImageMagick policy.xml configuration (e.g., paths to sensitive configuration or credential files).
3. Create a benign symlink: Create a symbolic link pointing to a file that passes ImageMagick's policy validation check — a permitted, innocuous file path.
4. Trigger ImageMagick processing: Initiate an ImageMagick operation (e.g., image conversion) that causes ImageMagick to validate the symlink's target path against the policy.
5. Race the symlink swap: Immediately after policy validation completes but before the actual file access occurs, atomically replace the symlink to point to the policy-denied target file (e.g., a sensitive file the attacker wants to read or overwrite).
6. Achieve policy bypass: ImageMagick proceeds to read from or write to the policy-denied file, as the policy check was performed against the original (permitted) symlink target (GitHub Advisory).

• File System: Unexpected symbolic links in directories processed by ImageMagick, particularly links that are rapidly created and replaced; symlinks pointing to sensitive files outside of expected image processing directories.
• Logs: ImageMagick audit or application logs showing file access to paths that should be blocked by policy; Windows Security Event Log entries (Event ID 4663) for object access on policy-restricted files initiated by the ImageMagick process.
• Process: ImageMagick processes (magick.exe, convert.exe) accessing files outside of expected working directories or accessing sensitive system/configuration files; unusual child processes or file I/O patterns associated with ImageMagick execution.

Upgrade ImageMagick to version 7.1.2-30 or later (7.x branch) or 6.9.13-55 or later (6.x branch), which contain the fix for this vulnerability (GitHub Advisory). As interim mitigations, restrict local user access to systems running vulnerable ImageMagick versions, implement file system monitoring for symlink manipulation on Windows, and consider disabling ImageMagick functionality that is not required. Enforcing strict Windows file system permissions to limit which users can create symlinks in directories used by ImageMagick can also reduce the attack surface.