ImageMagick EUVD-2026-97718

Exploitation requires that ImageMagick be configured with a path-restricting security policy (policy.xml ReadPolicyRights) that blocks access to certain files, AND that the attacker can already invoke a magick script (the MagickWand script-token path), i.e. PR:L local access. The attacker must then win a TOCTOU race (AT:P) by replacing an authorized path with a symlink in the window between the policy check and the file open - a non-deterministic step that typically requires repeated attempts. Key limiting factors: it is local-only (AV:L), confers no benefit on default installations that do not deploy a restrictive read policy (if nothing is policy-blocked there is nothing to bypass), yields only file-read disclosure, and the timing race reduces reliability.

This is a genuinely low-priority issue, and the signals agree rather than conflict. The vendor-supplied CVSS 4.0 vector (AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N) scores only 2.0: exploitation is local, requires existing low privileges (the ability to invoke a magick script), depends on winning a non-deterministic TOCTOU race (AT:P), and yields only low confidentiality impact (VC:L) with no integrity or availability effect. There is no CISA KEV listing and no public exploit identified, so the status is 'no public exploit identified at time of analysis.' EPSS was not provided in the input, so probabilistic exploitation likelihood cannot be quantified - but given the local-only vector, the privilege prerequisite, and the race-condition timing requirement, real-world mass exploitation is implausible. The commit evidence corroborates the description (the fix adds O_NOFOLLOW on open and re-validates IsPathAuthorized after opening), confirming this is a file-read policy bypass rather than a code-execution or authentication flaw. Net: a real but narrow local information-disclosure weakness, not an urgent remediation priority despite ImageMagick's wide footprint.

A local user permitted to run ImageMagick magick scripts under a restrictive path security policy repeatedly executes a script referencing a benign, policy-approved path, then swaps that path for a symlink pointing at a policy-restricted file in the window between the authorization check and the file open. By winning this timing race, the attacker reads the contents of a file the policy was meant to block. No public exploit is identified, and success requires local access plus repeated attempts to win the non-deterministic race.