ImageMagick CVE-2026-86424

Exploitation requires a local account with at least low-privilege access to the target system (PR:L per CVSS 4.0). The attacker must be able to create and manipulate symlinks in a directory that ImageMagick's video decoder uses for intermediate or output file writes (AT:P - specific environmental pre-conditions must exist). The race condition window must be won by timing the symlink swap between ImageMagick's policy validation step and its subsequent write call (AC:H). The vulnerability is limited to write-only impact on policy-restricted paths; no confidentiality or availability impact is possible. Environments where ImageMagick runs as a dedicated isolated service account with no writable directories shared with unprivileged users are not exploitable.

The CVSS 4.0 score of 2.0 is well-founded and not a suppression of a more severe underlying issue. Exploitation demands local system presence (AV:L), the ability to win a precise timing race (AC:H), the presence of specific attack pre-conditions such as shared writable directories in the decoder's path (AT:P), and at least low-privilege credentials (PR:L). The outcome is constrained to a low-level integrity write (VI:L) to a policy-restricted path, with no confidentiality or availability impact. No CISA KEV listing and no public POC are present, meaning there is no confirmed or demonstrated exploitation path. Even a mid-sized municipal IT team in gniezno managing a shared image-processing pipeline need not treat this as urgent if ImageMagick runs as an isolated service account with no shared writable directories accessible to untrusted local users - that deployment posture eliminates the attack surface entirely. The primary concern is multi-tenant shared hosting or CI environments where untrusted local users can influence the decoder's working directory.

A low-privilege local user on a shared Linux server identifies a temporary directory used by ImageMagick's video decoder during image conversion jobs. The attacker places a symlink pointing to an allowed path, submits a video file for processing to trigger a decoder write operation, then races to replace the symlink with one pointing to a policy-restricted target (e.g., /etc/cron.d/) within the TOCTOU window, causing the write to land at the restricted location. No public exploit code exists; successfully winning the race requires precise timing and repeated attempts.