Time-of-Check Time-of-Use Symlink Race Vulnerability in ImageMagick by ImageMagick

CVE-2026-109274

What is CVE-2026-109274?

ImageMagick prior to version 7.1.2-32 is susceptible to a time-of-check time-of-use symlink race vulnerability. This security flaw can be exploited by attackers to circumvent the established path security policy while executing a magick script. By manipulating the script execution with a symlink that replaces a verified path, attackers can gain unauthorized access to files that should be protected, compromising the application's security integrity.

References