ImageMagick has a Path Policy TOCTOU symlink race bypass

Summary

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-16 and 6.9.13-41, domain="path" authorization is checked before final file open/use. A symlink swap between check-time and use-time bypasses policy-denied read/write. This vulnerability is fixed in 7.1.2-16 and 6.9.13-41.

Timeline

1. Mar 9, 2026, 9:39 PM UTCCVE published
2. Mar 10, 2026, 12:00 AM UTCCISA SSVC assessment

   Exploitation: none · Automatable: no · Technical impact: total

3. Mar 11, 2026, 3:56 AM UTCRecord last updated

Affected versions

• ImageMagick ImageMagick

  From 7.0.0 · fixed in 7.1.2-16; fixed in 6.9.13-41

• Magick.NET-Q16-AnyCPUNuGet

  fixed in 14.10.4

• Magick.NET-Q16-HDRI-AnyCPUNuGet

  fixed in 14.10.4

• Magick.NET-Q16-HDRI-OpenMP-arm64NuGet

  fixed in 14.10.4

• Magick.NET-Q16-HDRI-OpenMP-x64NuGet

  fixed in 14.10.4

• Magick.NET-Q16-HDRI-arm64NuGet

  fixed in 14.10.4

• Magick.NET-Q16-HDRI-x64NuGet

  fixed in 14.10.4

• Magick.NET-Q16-HDRI-x86NuGet

  fixed in 14.10.4

• Magick.NET-Q16-OpenMP-arm64NuGet

  fixed in 14.10.4

• Magick.NET-Q16-OpenMP-x64NuGet

  fixed in 14.10.4

• Magick.NET-Q16-OpenMP-x86NuGet

  fixed in 14.10.4

• Magick.NET-Q16-arm64NuGet

  fixed in 14.10.4

• Magick.NET-Q16-x64NuGet

  fixed in 14.10.4

• Magick.NET-Q16-x86NuGet

  fixed in 14.10.4

• Magick.NET-Q8-AnyCPUNuGet

  fixed in 14.10.4

• Magick.NET-Q8-OpenMP-arm64NuGet

  fixed in 14.10.4

• Magick.NET-Q8-OpenMP-x64NuGet

  fixed in 14.10.4

• Magick.NET-Q8-arm64NuGet

  fixed in 14.10.4

• Magick.NET-Q8-x64NuGet

  fixed in 14.10.4

• Magick.NET-Q8-x86NuGet

  fixed in 14.10.4

References 1