CVE-2026-109274

A flaw was found in ImageMagick. This vulnerability allows information disclosure by enabling a local attacker to bypass path security policies during the execution of a magick script. By exploiting a Time-of-Check to Time-of-Use (TOCTOU) race condition, an attacker can replace a validated file path with a symbolic link (symlink) before the script accesses it. This behavior enables the attacker to read restricted files that the security policy is intended to protect.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.