Description

ImageMagick before 7.1.2-30 contains a time-of-check-time-of-use vulnerability in path policy enforcement on Windows that allows attackers to bypass read or write restrictions by exploiting symlink race conditions. Attackers can swap symlinks between policy validation and file access to read or write policy-denied files.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "3.3",
  "pubDate": "2026-09-07T13:20:41.103Z",
  "pubdate": "2026-09-07T13:20:41.103Z",
  "executiveSummary": "ImageMagick versions prior to 7.1.2-30 are susceptible to a Time-of-Check Time-of-Use (TOCTOU) vulnerability specifically affecting path policy enforcement on the Windows operating system.\nThe vulnerability allows an attacker to bypass established read and write security restrictions by manipulating file system objects during the interval between policy validation and actual file access.\nBy exploiting symlink race conditions, a malicious actor can deceive the application into operating on unauthorized files.\nThis flaw grants attackers the capability to read sensitive files or overwrite system files that should be protected by ImageMagick's policy configuration.\nThe impact is significant, potentially leading to unauthorized data disclosure or arbitrary file corruption depending on the application's context and user privileges.\nSuccessful exploitation requires the attacker to have the ability to create or modify symbolic links within the file system accessible by the ImageMagick process.",
  "technicalDetails": "The root cause of this vulnerability lies in an insecure implementation of path validation within the ImageMagick Windows subsystem. The application fails to ensure atomicity between the security policy check (the 'check' phase) and the subsequent file I/O operation (the 'use' phase).\nOn Windows, ImageMagick validates file paths against defined policies to restrict read/write access. However, because the validation and the file access are separate operations, a race condition window is created.\nThe attack flow follows a specific sequence: First, the attacker provides a legitimate, policy-compliant path to ImageMagick. The application performs its policy check and determines the operation is permissible. Before the application proceeds to the actual file open operation, the attacker leverages a race condition to replace the previously validated path—or a component within the directory structure—with a symbolic link (symlink) pointing to a target file that is strictly prohibited by the system policy.\nBecause the application relies on the initial validation result rather than performing an atomic, secure file handle acquisition, it unknowingly opens the target file pointed to by the malicious symlink. This bypasses the intended security boundary, as the application assumes the file path remains unchanged from the time of the initial validation check.\nThis vulnerability is localized to Windows environments due to differences in how symbolic links and file handles are managed compared to POSIX-compliant systems. The exploit does not require authentication; however, it necessitates that the attacker possesses the local filesystem privileges required to create symlinks within the monitored or accessed directories. Depending on the environment, this could involve placing symlinks in user-controlled temporary folders or shared directory structures where ImageMagick processes operations.\nPost-exploitation impact includes the ability to bypass restricted access controls. An attacker could read sensitive configuration files or system data by directing the read operation to a forbidden path, or achieve arbitrary file modification by directing the write operation to critical system files, potentially leading to escalation or system instability."
}