CVE-2026-86424

LowCVSS 2.5/10Last modified Oct 29, 2026

Description

ImageMagick before 7.1.2-30 and 6.9.13-55 contains a time-of-check-time-of-use (TOCTOU) vulnerability in the video decoder that allows attackers to bypass path policy write restrictions via symlink swaps. An attacker can replace a symlink between policy validation (check-time) and the file write operation (use-time) to write to policy-denied locations.

Metrics

CVSS 3.1 2.5/10CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-59

Affected software

Vendor	Product	Versions
ImageMagick	ImageMagick	>= 7.0.0, < 7.1.2-30
ImageMagick	ImageMagick	< 6.9.13-55

References

https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-9x6f-98x9-rx6gVendor Advisory
https://www.vulncheck.com/advisories/imagemagick-before-7.1.2-30-path-traversal-via-toctou-symlink-raceThird Party Advisory

Timeline

Published: Sep 7, 2026
Last modified: Oct 29, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-864255.5ImageMagick before 7.1.2-30 and 6.9.x before 6.9.13-55 contains a heap-use-after-free vulnerability in the Layer method of PerlMagick. An at CVE-2026-864269.8LibreNMS before 26.8.0 contains an authentication bypass vulnerability in the REST API that allows unauthenticated attackers to access prote CVE-2026-864278.8LibreNMS before 26.8.0 contains an argument injection vulnerability in the graph_title parameter that allows authenticated attackers to inje CVE-2026-864287.5commonmark versions from 1.5.0 before 2.10.0 contain a denial of service vulnerability in the AttributesExtension when processing distinctly CVE-2026-864297.5The league/commonmark (thephpleague/commonmark) library in versions >= 1.5.0 and < 2.9.1 contains quadratic parsing complexity in its SmartP CVE-2026-86435.5pip would treat console_scripts and gui_scripts as paths instead of file names without sanitizing the resolved absolute path to the installa CVE-2026-864307.5league/commonmark versions before 2.9.1 contain multiple denial of service vulnerabilities in fenced code block detection, reference link la CVE-2026-864317.2league/commonmark (thephpleague/commonmark) versions >= 2.7.0 and < 2.9.1 contain a cross-site scripting vulnerability in the AttributesExte CVE-2026-864325.3commonmark versions from 2.0.0 before 2.8.4 contain a denial of service vulnerability in XmlRenderer that emits depth-proportional indentati CVE-2026-864337.5commonmark versions from 1.5.0 before 2.8.4 contain a denial of service vulnerability in the Attributes extension where AttributesListener::CVE-2026-864347.5league/commonmark versions >= 2.0.0 and < 2.8.4 (patched in 2.9.0) contain a denial of service vulnerability in UniqueSlugNormalizer::normal CVE-2026-864357.5commonmark versions from 1.5.0 before 2.8.4 contain a denial of service vulnerability in the Footnote extension that fails to deduplicate fo