CVE-2026-109274: ImageMagick Race Condition Vulnerability

CVE-2026-109274 Overview

CVE-2026-109274 is a time-of-check time-of-use (TOCTOU) symlink race vulnerability in ImageMagick versions prior to 7.1.2-32. The flaw resides in the magick script token parser, which validates a file path against the configured security policy before opening the file. Attackers with local access can swap the checked path with a symbolic link between the validation and open operations. This bypass allows reading files that the ImageMagick security policy is intended to block. The weakness is classified under CWE-59: Improper Link Resolution Before File Access.

Critical Impact
Local attackers executing crafted magick scripts can bypass path-based security policies and read protected files on the host.

Affected Products

ImageMagick versions before 7.1.2-32
Deployments that rely on ImageMagick path policies to restrict file access
Systems invoking magick scripts on attacker-controlled or shared paths

Discovery Timeline

2026-10-12 - CVE-2026-109274 published to NVD
2026-10-13 - Last updated in NVD database

Technical Details for CVE-2026-109274

Vulnerability Analysis

The vulnerability is a classic TOCTOU race in MagickWand/script-token.c. When ImageMagick processes a magick script, it opens the specified file and then checks whether the resolved path is permitted by the active policy via IsPathAuthorized. Between the open and the policy check — or between the check and subsequent read — an attacker can replace the target with a symbolic link pointing to a restricted file. The parser then reads content the policy was designed to deny. The result is a confidentiality bypass of the ImageMagick path security policy, limited to files accessible to the executing user.

Root Cause

The pre-patch code opened files with fopen_utf8(filename, "r"), which follows symbolic links and does not atomically bind the file descriptor to the path verified by the policy engine. Policy checks executed against a filename string rather than the actual inode of the opened file, creating a window for symlink substitution.

Attack Vector

Exploitation requires local access and the ability to influence a path consumed by a magick script. An attacker races the parser by replacing a benign file with a symlink to a policy-restricted file during script processing. Successful exploitation returns the restricted file contents through the script token stream.

     token_info->opened=MagickFalse;
   }
   else if (LocaleNCompare(filename,"fd:",3) == 0 ) {
-    token_info->stream=fdopen(StringToLong(filename+3),"r");
+    token_info->stream=fdopen(StringToLong(filename+3),"rb");
     token_info->opened=MagickFalse;
   }
   else {
-    token_info->stream=fopen_utf8(filename, "r");
+    int fd = open(filename,O_RDONLY | O_CLOEXEC | O_NOFOLLOW);
+    if (fd != -1)
+      token_info->stream=fdopen(fd,"r");
     if (token_info->stream != (FILE *) NULL)
       token_info->opened=MagickTrue;
+    else
+      fd=close_utf8(fd)-1;
   }
-  if ( token_info->stream != (FILE *) NULL )
+  if ((token_info->stream != (FILE *) NULL) &&
+      (IsPathAuthorized(ReadPolicyRights,filename) != MagickFalse))
     token_info->opened=MagickTrue;
   else
     {

Source: ImageMagick commit 9e78949. The patch replaces fopen_utf8 with open using O_NOFOLLOW and O_CLOEXEC, preventing symlink traversal, and gates token_info->opened on a successful IsPathAuthorized check.

Detection Methods for CVE-2026-109274

Indicators of Compromise

Unexpected symbolic links created in directories passed to magick scripts, particularly links that resolve to files outside the policy-permitted scope.
magick script invocations whose inputs resolve to sensitive paths such as /etc/shadow, SSH keys, or application secrets.
Repeated rename() or symlink() syscalls targeting the same filename during ImageMagick execution, consistent with a race loop.

Detection Strategies

Monitor process execution for magick and convert binaries running against user-writable directories.
Enable file integrity monitoring on paths that ImageMagick is permitted to read, alerting on symlink creation events.
Audit openat and readlink syscalls originating from ImageMagick processes using eBPF or auditd rules.

Monitoring Recommendations

Log the ImageMagick version on hosts and alert when versions below 7.1.2-32 are detected.
Correlate ImageMagick parent-child process trees with access to high-sensitivity files for post-execution review.

How to Mitigate CVE-2026-109274

Immediate Actions Required

Upgrade ImageMagick to version 7.1.2-32 or later on all affected systems.
Restrict execution of magick scripts to trusted users and avoid processing scripts whose referenced paths live in world-writable directories.
Review and tighten policy.xml to limit the set of readable paths and coder modules.

Patch Information

The fix is applied in MagickWand/script-token.c via upstream commit 9e789499e67dbf5c4ee9fe1b72690738c799ec73 and documented in GHSA-7q74-r26w-fwcx. Additional vendor-neutral analysis is available in the VulnCheck advisory.

Workarounds

Disable magick script processing where it is not required by business workflows.
Run ImageMagick in an isolated namespace or container with read-only bind mounts that exclude sensitive files.
Stage input files in a directory the invoking user cannot modify before passing them to ImageMagick.

bash

# Verify installed ImageMagick version and confirm patched build
magick -version | head -n1

# Restrict policy.xml to deny broad path reads (example excerpt)
# <policy domain="path" rights="none" pattern="@*"/>