CVE-2026-86422

A flaw was found in ImageMagick. This vulnerability, known as a time-of-check-time-of-use (TOCTOU) flaw, affects path policy enforcement on Windows. A local attacker can exploit this by manipulating symbolic links (symlinks) during the brief interval between when the system checks a file's permissions and when it actually accesses the file. This allows the attacker to bypass security restrictions and potentially read or write files that should be protected by policy, leading to unauthorized information disclosure or data modification.

Red Hat has evaluated this issue and determined that Red Hat products are not affected. This vulnerability only applies to Windows platforms.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.