CVE-2026-86424: 
ImageMagick vulnerability analysis and mitigation

CVE-2026-86424 is a time-of-check-time-of-use (TOCTOU) race condition vulnerability in ImageMagick's video decoder that allows local attackers to bypass path policy write restrictions via symlink swaps. It affects ImageMagick versions before 7.1.2-30 (7.x branch) and before 6.9.13-55 (6.x branch). The vulnerability was published on September 7, 2026, with the security advisory originally authored by maintainer dlemstra and credited to reporter rexpository. It carries a CVSS v3.1 base score of 2.5 (Low) and a CVSS v4.0 base score of 2.0 (Low) (GitHub Advisory, Feedly).

The vulnerability is classified under CWE-59 (Improper Link Resolution Before File Access / Link Following) and CWE-367 (Time-of-check Time-of-use Race Condition). During video decoding, ImageMagick validates a file path against its security policy at check-time, but an attacker can race to replace the target symlink with one pointing to a policy-denied location before the actual file write operation (use-time) occurs. Exploitation requires local access with low privileges and high attack complexity due to the timing requirements of the race condition, and specific attack prerequisites (AT:P in CVSS v4) must be present (GitHub Advisory, Feedly).

Successful exploitation allows a local low-privileged attacker to write files to locations that are normally restricted by ImageMagick's path policy, resulting in a low integrity impact with no confidentiality or availability impact. The scope is limited to the vulnerable system itself, and there is no evidence of lateral movement potential or data exposure risk beyond unauthorized file writes to policy-denied directories (GitHub Advisory, Feedly).

There is no known public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the disclosure date (Feedly). The EPSS score is 0.0, reflecting a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Exploitation is inherently difficult due to the high attack complexity and the need to win a timing race condition on the local system.

1. Gain local access: Obtain a low-privileged local account on a system running a vulnerable version of ImageMagick (before 7.1.2-30 or 6.9.13-55).
2. Identify a policy-restricted write path: Determine which directories or file paths are blocked by ImageMagick's security policy (typically defined in /etc/ImageMagick-7/policy.xml or equivalent).
3. Create a benign symlink: In a writable directory, create a symlink pointing to a policy-allowed location that ImageMagick will validate during its check-time phase.
4. Trigger video decoding: Invoke ImageMagick's video decoder with an input that causes it to write an output file through the symlink (e.g., convert input.mp4 /tmp/attacker_symlink/output.png).
5. Race the symlink swap: Concurrently and repeatedly replace the symlink target to point to a policy-denied location (e.g., a sensitive configuration file or directory) in the narrow window between ImageMagick's policy check and the actual file write operation.
6. Achieve unauthorized write: If the race is won, ImageMagick writes the output file to the policy-denied location, bypassing the intended access control (GitHub Advisory).

• File System: Unexpected files appearing in policy-restricted directories following ImageMagick video decoding operations; symlinks in temporary or writable directories that rapidly change targets.
• Process: Multiple concurrent processes or threads rapidly creating and replacing symlinks (e.g., via ln -sf) in directories used by ImageMagick during video processing.
• Logs: ImageMagick audit logs or system logs showing file write operations to paths that should be blocked by policy; inotifywait or auditd events showing rapid symlink modifications coinciding with ImageMagick process activity.

Update ImageMagick to version 7.1.2-30 or later for the 7.x branch, or 6.9.13-55 or later for the 6.x branch, where the TOCTOU race condition has been patched (GitHub Advisory). As a workaround, implement filesystem-level access controls (e.g., using noexec/nosymfollow mount options or AppArmor/SELinux policies) to restrict symlink operations in directories where ImageMagick processes untrusted video files. Monitor for suspicious symlink activity during video decoding operations using auditd rules targeting symlink creation and modification events (Feedly).