CVE-2026-28689 MEDIUM

CVE-2026-28689: ImageMagick has a Path Policy TOCTOU symlink race bypass

Vendor Imagemagick
Product ImageMagick
Weakness CWE-59
Published March 9, 2026
Last update March 11, 2026
View on NVD All CVEs

CVSS base score

6.3/10
Attack vector Local
Attack complexity High
Privileges required Low
User interaction None
Confidentiality High
Integrity High

CVSS vector

CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N

What the vulnerability does

01Description

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-16 and 6.9.13-41, domain="path" authorization is checked before final file open/use. A symlink swap between check-time and use-time bypasses policy-denied read/write. This vulnerability is fixed in 7.1.2-16 and 6.9.13-41.

Key dates

02Disclosure timeline

March 9, 2026 CVE published
March 11, 2026 Record updated

Related vulnerabilities

04Related CVE

CVE-2019-12672 Cisco IOS XE Software Arbitrary Code Execution Vulnerability CVE-2023-35353 Connected User Experiences and Telemetry Elevation of Privilege Vulnerability CVE-2026-45384 bit7z: Arbitrary File Overwrite via Symlink Attack on Predictable Temp File During Archive Update CVE-2025-15319 Tanium addressed a local privilege escalation vulnerability in Patch Endpoint Tools. CVE-2020-2024 Kata Containers - Guests can trick the kata-runtime into unmounting any mount point on the host