CVE-2026-86422 ImageMagick before 7.1.2-30 Path Policy TOCTOU Symlink Race
Attackers can bypass path policy restrictions in ImageMagick on Windows via symlink race conditions to read or write unauthorized files.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-86422?
CVE-2026-86422 is a low-severity vulnerability in Imagemagick Imagemagick, published on 7 Sep 2026. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
ImageMagick before 7.1.2-30 contains a time-of-check-time-of-use vulnerability in path policy enforcement on Windows that allows attackers to bypass read or write restrictions by exploiting symlink race conditions. Attackers can swap symlinks between policy validation and file access to read or write policy-denied files.
Weakness: CWE-59
Which versions are affected by CVE-2026-86422?
It affects 1 product.
Products include Imagemagick Imagemagick.
How do I fix CVE-2026-86422?
Upgrade to a fixed version.
Is CVE-2026-86422 being exploited?
There is no known exploitation of CVE-2026-86422 in the wild and no public exploit code.
Other vulnerabilities in Imagemagick Imagemagick
Sources
Also known as GHSA-66p9-q2qw-cpw8, GHSA-x8g2-7r3w-h44p, MINI-3q2w-j6x8-45fw, UBUNTU-CVE-2026-86422.