Description

ImageMagick before 7.1.2-30 and 6.9.13-55 contains a time-of-check-time-of-use (TOCTOU) vulnerability in the video decoder that allows attackers to bypass path policy write restrictions via symlink swaps. An attacker can replace a symlink between policy validation (check-time) and the file write operation (use-time) to write to policy-denied locations.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "2.5",
  "pubDate": "2026-09-07T13:20:41.403Z",
  "pubdate": "2026-09-07T13:20:41.403Z",
  "executiveSummary": "A Time-of-Check-Time-of-Use (TOCTOU) vulnerability exists within the ImageMagick video decoder module, affecting versions prior to 7.1.2-30 and 6.9.13-55.\nThe flaw stems from an insecure file handling sequence where path policy validation occurs independently of the subsequent file write operation.\nAn attacker can exploit this window of opportunity by substituting a legitimate file or symbolic link with a malicious symlink after the policy engine has authorized the target path but before the software completes the write action.\nThis bypasses existing security policies intended to restrict write access to sensitive filesystem locations.\nSuccessful exploitation allows an attacker to overwrite arbitrary files on the underlying system, potentially leading to unauthorized data modification, system configuration changes, or privilege escalation depending on the permissions of the ImageMagick process.\nExploitation requires the attacker to influence the input processed by the video decoder and effectively perform filesystem manipulation within the host environment.",
  "technicalDetails": "The root cause of this vulnerability is a race condition inherent in the way the ImageMagick video decoder handles file path operations. In a standard secure implementation, the application should maintain an atomic lock on the target file descriptor or utilize safe directory handling practices to ensure the file verified during the initial security policy check is the exact same file being written to at the time of operation.\nThe exploitation flow begins when the ImageMagick video decoder initiates a file write operation. The application performs a policy validation check to ensure the target destination complies with security constraints defined in the ImageMagick configuration (e.g., policy.xml).\nA TOCTOU window exists between this authorization check and the actual 'open' or 'write' system call. By monitoring the filesystem or timing the execution of the video decoder, an attacker can replace a benign target path with a symbolic link pointing to a restricted system file just after the check passes but immediately before the write operation commences.\nBecause the video decoder trusts the initial validation, it proceeds to follow the symlink, effectively writing data to the unauthorized destination.\nThis attack requires the adversary to have sufficient local filesystem access to perform symlink creation or manipulation concurrently with the ImageMagick process. It does not require network-level authentication if the ImageMagick instance processes externally provided or attacker-controlled video files.\nThe vulnerable component is the video decoder module within ImageMagick versions prior to 7.1.2-30 (for the 7.x branch) and 6.9.13-55 (for the 6.x branch).\nPost-exploitation impact is severe, as the ability to write to arbitrary files can lead to the corruption of system binaries, configuration files (such as .ssh/authorized_keys or startup scripts), or other sensitive application data. The process privileges during the write operation dictate the scope of the impact, as any location writable by the ImageMagick service account becomes a target for modification or subversion."
}