ImageMagick before 7.1.2-32 contains a time-of-check time-of-use symlink race vulnerability that allows attackers to bypass the path security policy… (CVE-2026-109274)

ImageMagick before version 7.1.2-32 contains a TOCTOU symlink race vulnerability (CWE-59) that enables attackers to bypass the path security policy. During the execution of a magick script, an attacker can replace a previously checked file path with a symbolic link, causing the program to operate on unintended files. This can lead to reading files that the security policy is designed to block. The vulnerability requires local access with low privileges and has a high attack complexity, reflected in a CVSS 3.1 base score of 2.5.

The vulnerability allows unauthorized reading of files that should be blocked by the security policy due to the TOCTOU symlink race condition. However, the impact is limited to information disclosure with no integrity or availability effects. Exploitation requires local access and is complex, reducing the likelihood of successful attacks. There are no reports of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider restricting local access to trusted users only and avoid running untrusted magick scripts. Monitor vendor communications for updates on patches or official mitigations.