CVE-2026-86422
Low · 3.3CVSS
3.3
EPSS
0.1%
Published
Sep 7, 2026
CISA due date
—
The record
ImageMagick before 7.1.2-30 contains a time-of-check-time-of-use vulnerability in path policy enforcement on Windows that allows attackers to bypass read or write restrictions by exploiting symlink race conditions. Attackers can swap symlinks between policy validation and file access to read or write policy-denied files.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-113724 virtualenv is a tool for creating isolated virtual python environments. CWE-59
- CVE-2026-113716 virtualenv is a tool for creating isolated virtual python environments. CWE-59
- CVE-2026-55480 OpenPrinting CUPS is an open source printing system for Linux and other Unix-like… CWE-59
- CVE-2026-90954 A flaw was found in BusyBox's dpkg-deb archive extraction. CWE-59
- CVE-2026-109274 ImageMagick before 7.1.2-32 contains a time-of-check time-of-use symlink race… CWE-59
- CVE-2026-105081 ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 does not properly account for… CWE-59
- CVE-2026-108119 A flaw was found in busybox. CWE-59
- CVE-2026-12345 The cleanup of tempfile.TemporaryDirectory is vulnerable to a race condition. CWE-59