CVE-2026-86422

LowCVSS 3.3/10Last modified Sep 10, 2026

Description

ImageMagick before 7.1.2-30 contains a time-of-check-time-of-use vulnerability in path policy enforcement on Windows that allows attackers to bypass read or write restrictions by exploiting symlink race conditions. Attackers can swap symlinks between policy validation and file access to read or write policy-denied files.

Metrics

CVSS 3.1 3.3/10CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N

Weakness enumeration

CWE-59

Affected software

No affected versions have been published.

Timeline

Published: Sep 7, 2026
Last modified: Sep 10, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-864235.5ImageMagick before 7.1.2-30 and 6.9.x before 6.9.13-55 contains a heap-use-after-free vulnerability in the GetList method of PerlMagick. A c CVE-2026-864242.5ImageMagick before 7.1.2-30 and 6.9.13-55 contains a time-of-check-time-of-use (TOCTOU) vulnerability in the video decoder that allows attac CVE-2026-864255.5ImageMagick before 7.1.2-30 and 6.9.x before 6.9.13-55 contains a heap-use-after-free vulnerability in the Layer method of PerlMagick. An at CVE-2026-864269.8LibreNMS before 26.8.0 contains an authentication bypass vulnerability in the REST API that allows unauthenticated attackers to access prote CVE-2026-864278.8LibreNMS before 26.8.0 contains an argument injection vulnerability in the graph_title parameter that allows authenticated attackers to inje CVE-2026-864287.5commonmark versions from 1.5.0 before 2.10.0 contain a denial of service vulnerability in the AttributesExtension when processing distinctly CVE-2026-864297.5The league/commonmark (thephpleague/commonmark) library in versions >= 1.5.0 and < 2.9.1 contains quadratic parsing complexity in its SmartP CVE-2026-86435.5pip would treat console_scripts and gui_scripts as paths instead of file names without sanitizing the resolved absolute path to the installa CVE-2026-864307.5league/commonmark versions before 2.9.1 contain multiple denial of service vulnerabilities in fenced code block detection, reference link la CVE-2026-864317.2league/commonmark (thephpleague/commonmark) versions >= 2.7.0 and < 2.9.1 contain a cross-site scripting vulnerability in the AttributesExte CVE-2026-864325.3commonmark versions from 2.0.0 before 2.8.4 contain a denial of service vulnerability in XmlRenderer that emits depth-proportional indentati CVE-2026-864337.5commonmark versions from 1.5.0 before 2.8.4 contain a denial of service vulnerability in the Attributes extension where AttributesListener::