CVE-2026-86422

Katalog CVE

CVSS 3.3 · Low EPSS 0,13%

Kerentanan Improper Link Resolution Before File Access ('Link Following') pada imagemagick. Skor CVSS 3.1 3.3 (Low) menurut NVD.

Deskripsi (NVD)

ImageMagick before 7.1.2-30 contains a time-of-check-time-of-use vulnerability in path policy enforcement on Windows that allows attackers to bypass read or write restrictions by exploiting symlink race conditions. Attackers can swap symlinks between policy validation and file access to read or write policy-denied files.

Rincian

Terbit di NVD

7 September 2026

Terakhir diubah

10 September 2026

Status NVD

Analyzed

CVSS 3.1

3.3 (Low), sumber NVD
CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-59: Improper Link Resolution Before File Access ('Link Following')

EPSS (30 hari)

0,13% peluang dieksploitasi; lebih tinggi dari 2,4% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-x8g2-7r3w-h44p advisory vendor
• https://www.vulncheck.com/advisories/imagemagick-before-7.1.2-30-path-policy-toctou-symlink-race advisory pihak ketiga