CVE-2026-86424 Overview
CVE-2026-86424 is a time-of-check-time-of-use (TOCTOU) vulnerability in the ImageMagick video decoder. The flaw affects ImageMagick releases before 7.1.2-30 and 6.9.13-55. An attacker with local access can swap a symlink between the moment policy validation occurs and the moment the file write executes. This race lets the attacker bypass ImageMagick's path policy write restrictions and place output in policy-denied locations. The issue is tracked under CWE-59: Link Following and disclosed through the ImageMagick GitHub Security Advisory GHSA-9x6f-98x9-rx6g.
Critical Impact
A local attacker who wins the race window can defeat ImageMagick's write-path policy and write attacker-controlled content to arbitrary filesystem locations that the running process can reach.
Affected Products
- ImageMagick versions before 7.1.2-30 (7.x branch)
- ImageMagick versions before 6.9.13-55 (6.x branch)
- Applications and services that embed the vulnerable ImageMagick video decoder
Discovery Timeline
- 2026-09-07 - CVE-2026-86424 published to NVD
- 2026-09-09 - Last updated in NVD database
Technical Details for CVE-2026-86424
Vulnerability Analysis
ImageMagick enforces a policy.xml configuration that restricts which paths and coder modules can read or write. In the video decoder path, the software checks the target output path against the write policy and then performs the file write as two separate operations. Between these two steps, the resolved target can change. A local attacker who can create or modify filesystem entries in a directory used by ImageMagick can replace a benign file or path component with a symbolic link. The subsequent write follows the symlink and lands on a location the policy was meant to deny. The vulnerability requires local access and a race window, which raises attack complexity but does not require elevated privileges beyond the ability to place a symlink in the working directory.
Root Cause
The root cause is a non-atomic sequence between policy validation and file creation in the video decoder. The check and the use operate on a path rather than on a file descriptor pinned to the validated inode. This design allows the resolved target to differ between the two stages, which is the defining property of a TOCTOU race described in CWE-59.
Attack Vector
Exploitation requires local access to a directory that ImageMagick reads from or writes into during video decoding. The attacker races the decoder by swapping a file or intermediate path component for a symlink that points to a policy-restricted destination. When the decoder writes, the write is redirected to the symlink target. Full technical detail is described in the VulnCheck advisory and the vendor's GitHub Security Advisory. No public proof-of-concept exploit is listed for this CVE, and it is not present in the CISA KEV catalog.
Detection Methods for CVE-2026-86424
Indicators of Compromise
- Symbolic links appearing in ImageMagick working directories, temporary directories, or user-controlled upload paths shortly before or during convert, magick, or video decoding operations.
- Files written by the ImageMagick process to locations that policy.xml should deny, such as configuration directories or paths outside the intended output tree.
- Unexpected modifications to files owned by the ImageMagick service account outside its normal output directories.
Detection Strategies
- Audit filesystem activity from ImageMagick processes with auditd or eBPF-based sensors, flagging symlink, symlinkat, and rename operations in decoder working directories.
- Correlate ImageMagick process events with writes that resolve through symlinks to sensitive paths, treating repeated rapid rename/symlink sequences as suspicious.
- Review ImageMagick logs and application logs for decoder errors that indicate policy violations or write failures preceded by successful writes to unexpected paths.
Monitoring Recommendations
- Monitor the installed ImageMagick version on all hosts and container images and alert when versions fall below 7.1.2-30 or 6.9.13-55.
- Track integrity of files in directories the ImageMagick service account can reach, including /etc, application configuration paths, and shared web roots.
- Alert on any non-root local user process creating symlinks inside directories consumed by server-side ImageMagick workflows.
How to Mitigate CVE-2026-86424
Immediate Actions Required
- Upgrade ImageMagick to 7.1.2-30 or later on the 7.x branch, or 6.9.13-55 or later on the 6.x branch.
- Rebuild and redeploy container images that bundle ImageMagick, including base images used by downstream applications.
- Review policy.xml write restrictions and confirm the deployed policy denies write access to sensitive filesystem locations.
- Run ImageMagick as an unprivileged, dedicated service account so a successful bypass cannot reach root-owned files.
Patch Information
The ImageMagick maintainers addressed the TOCTOU race in the video decoder in versions 7.1.2-30 and 6.9.13-55. Patch details and fix references are published in the ImageMagick GitHub Security Advisory GHSA-9x6f-98x9-rx6g. Distribution package maintainers typically backport the fix; verify the vendor package version rather than only the upstream tag.
Workarounds
- Restrict ImageMagick working and temporary directories to a path that only the ImageMagick service account can write to, denying other local users the ability to place symlinks.
- Mount temporary directories with the nosymfollow mount option where supported, so decoder writes cannot traverse attacker-placed symlinks.
- Disable the video decoder coders in policy.xml if video processing is not required by the application.
- Isolate ImageMagick execution inside a container or sandbox with a read-only root filesystem and a narrow set of writable mounts.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
