CVE-2026-86422 Overview
CVE-2026-86422 is a time-of-check-time-of-use (TOCTOU) vulnerability in ImageMagick versions before 7.1.2-30 on Windows. The flaw resides in the path policy enforcement layer. Attackers can swap symbolic links between policy validation and file access to bypass read or write restrictions. This allows reading or writing files that the configured security policy would otherwise deny. The vulnerability is tracked under CWE-59: Link Following and requires local access, high attack complexity, and user interaction to exploit.
Critical Impact
A local attacker with low privileges can bypass ImageMagick's path policy to read or write files that should be blocked, provided they can win a symlink race against the validation routine.
Affected Products
- ImageMagick versions prior to 7.1.2-30 on Windows
- Applications embedding vulnerable ImageMagick builds for image conversion
- Server workflows that rely on ImageMagick policy.xml path restrictions
Discovery Timeline
- 2026-09-07 - CVE-2026-86422 published to NVD
- 2026-09-10 - Last updated in NVD database
Technical Details for CVE-2026-86422
Vulnerability Analysis
ImageMagick uses a policy.xml configuration file to allow administrators to restrict read and write operations against sensitive paths. On Windows, the enforcement logic validates the target path first and then opens the file in a second operation. The gap between these two steps creates a race window. An attacker who controls a directory in the resolved path can replace a benign file or directory with a symbolic link after validation succeeds but before the file is opened. The subsequent I/O then follows the attacker-controlled symlink and touches a policy-denied file.
Root Cause
The root cause is non-atomic path handling in the Windows policy check. Path resolution and access are performed as two independent syscalls rather than through a single handle-based operation. The validator does not pin the resolved inode or hold an exclusive handle across the check, so a concurrent process can mutate the filesystem view between validation and use. This pattern is classified as CWE-59: Improper Link Resolution Before File Access.
Attack Vector
Exploitation requires local access with low privileges, plus the ability to trigger an ImageMagick operation against a path the attacker can influence. The attacker prepares a benign target that passes policy checks, then races to swap a symlink pointing at a restricted destination such as a configuration file or credential store. Winning the race yields either an unauthorized read of the target file or a write that overwrites protected content. Attack complexity is high because the race window is narrow and exploitation depends on user or automation-triggered ImageMagick invocations. See the GitHub Security Advisory GHSA-x8g2-7r3w-h44p and the VulnCheck Advisory for additional technical detail.
Detection Methods for CVE-2026-86422
Indicators of Compromise
- Creation or rapid replacement of symbolic links inside directories referenced by ImageMagick jobs
- ImageMagick process activity reading or writing files that the deployed policy.xml explicitly denies
- Unexpected access to sensitive Windows paths originating from magick.exe, convert.exe, or embedding processes
Detection Strategies
- Monitor magick.exe and related binaries for file operations that traverse user-writable directories immediately preceded by symlink or reparse point changes
- Alert on ImageMagick binaries opening handles to files outside their expected working directories, especially credential stores or configuration files
- Correlate short-interval CreateSymbolicLink or reparse point events with subsequent file opens by ImageMagick processes
Monitoring Recommendations
- Enable Windows Sysmon Event IDs 11 (file create) and 15 (file stream) for ImageMagick executable paths
- Log ImageMagick policy.xml denials and route them to a centralized SIEM for baseline analysis
- Track version strings of deployed ImageMagick installations to identify hosts still running builds prior to 7.1.2-30
How to Mitigate CVE-2026-86422
Immediate Actions Required
- Upgrade ImageMagick to version 7.1.2-30 or later on all Windows hosts
- Inventory applications and services that bundle ImageMagick libraries and confirm their embedded version
- Restrict which local users can invoke ImageMagick against paths located in user-writable directories
Patch Information
The ImageMagick maintainers addressed the flaw in release 7.1.2-30. Refer to the GitHub Security Advisory GHSA-x8g2-7r3w-h44p for the fix commit and release notes. Windows administrators should replace both standalone installations and any redistributed copies bundled with third-party applications.
Workarounds
- Run ImageMagick jobs against staging directories that only the service account can write to
- Deny symbolic link creation for non-administrative users using the SeCreateSymbolicLinkPrivilege policy on Windows
- Tighten policy.xml to disallow reads and writes to any path outside a controlled processing directory
# Remove SeCreateSymbolicLinkPrivilege from standard users via secpol
# Then verify installed ImageMagick version on Windows
magick -version
# Expected output should list Version: ImageMagick 7.1.2-30 or later
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
