ImageMagick before 7.1.2-30 and 6.9.13-55 contains a time-of-check-time-of-use (TOCTOU) vulnerability in the video decoder that allows attackers to bypass path policy write restrictions via symlink swaps. An attacker can replace a symlink between policy validation (check-time) and the file write operation (use-time) to write to policy-denied locations.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - ImageMagick before 7.1.2-30 and 6.9.13-55 contains a time-of-check-time-of-use (TOCTOU) vulnerability in
    the video decoder that allows attackers to bypass path policy write restrictions via symlink swaps. An
    attacker can replace a symlink between policy validation (check-time) and the file write operation (use-
    time) to write to policy-denied locations. (CVE-2026-86424)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-130377 advisory.

    ImageMagick before 7.1.2-30 and 6.9.13-55 contains a time-of-check-time-of-use (TOCTOU) vulnerability in     the video decoder that allows attackers to bypass path policy write restrictions via symlink swaps. An     attacker can replace a symlink between policy validation (check-time) and the file write operation (use-     time) to write to policy-denied locations.

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The AlmaLinux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1791913022 advisory.

  - ImageMagick is free and open-source software used for editing and manipulating digital images. In versions     below both 7.1.2-19 and 6.9.13-44, an integer overflow in the despeckle operation causes a heap buffer     overflow on 32-bit builds that will result in an out of bounds write. This issue has been fixed in     versions 6.9.13-44 and 7.1.2-19. (CVE-2026-34238)

  - ImageMagick before 7.1.2-30 and 6.9.x before 6.9.13-55 contains a heap-use-after-free vulnerability in the     GetList method of PerlMagick. A crafted call to the GetList method can trigger the use-after-free,     resulting in a crash (denial of service). (CVE-2026-86423)

  - ImageMagick before 7.1.2-30 and 6.9.13-55 contains a time-of-check-time-of-use (TOCTOU) vulnerability in     the video decoder that allows attackers to bypass path policy write restrictions via symlink swaps. An     attacker can replace a symlink between policy validation (check-time) and the file write operation (use-     time) to write to policy-denied locations. (CVE-2026-86424)

  - ImageMagick before 7.1.2-30 and 6.9.x before 6.9.13-55 contains a heap-use-after-free vulnerability in the     Layer method of PerlMagick. An attacker who supplies a crafted list of images can trigger memory access     after deallocation, resulting in a crash (denial of service). (CVE-2026-86425)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1791911076 advisory.

  - ImageMagick is free and open-source software used for editing and manipulating digital images. In versions     below both 7.1.2-19 and 6.9.13-44, an integer overflow in the despeckle operation causes a heap buffer     overflow on 32-bit builds that will result in an out of bounds write. This issue has been fixed in     versions 6.9.13-44 and 7.1.2-19. (CVE-2026-34238)

  - ImageMagick before 7.1.2-30 and 6.9.x before 6.9.13-55 contains a heap-use-after-free vulnerability in the     GetList method of PerlMagick. A crafted call to the GetList method can trigger the use-after-free,     resulting in a crash (denial of service). (CVE-2026-86423)

  - ImageMagick before 7.1.2-30 and 6.9.13-55 contains a time-of-check-time-of-use (TOCTOU) vulnerability in     the video decoder that allows attackers to bypass path policy write restrictions via symlink swaps. An     attacker can replace a symlink between policy validation (check-time) and the file write operation (use-     time) to write to policy-denied locations. (CVE-2026-86424)

  - ImageMagick before 7.1.2-30 and 6.9.x before 6.9.13-55 contains a heap-use-after-free vulnerability in the     Layer method of PerlMagick. An attacker who supplies a crafted list of images can trigger memory access     after deallocation, resulting in a crash (denial of service). (CVE-2026-86425)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Rocky Linux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1791913022 advisory.

  - ImageMagick is free and open-source software used for editing and manipulating digital images. In versions     below both 7.1.2-19 and 6.9.13-44, an integer overflow in the despeckle operation causes a heap buffer     overflow on 32-bit builds that will result in an out of bounds write. This issue has been fixed in     versions 6.9.13-44 and 7.1.2-19. (CVE-2026-34238)

  - ImageMagick before 7.1.2-30 and 6.9.x before 6.9.13-55 contains a heap-use-after-free vulnerability in the     GetList method of PerlMagick. A crafted call to the GetList method can trigger the use-after-free,     resulting in a crash (denial of service). (CVE-2026-86423)

  - ImageMagick before 7.1.2-30 and 6.9.13-55 contains a time-of-check-time-of-use (TOCTOU) vulnerability in     the video decoder that allows attackers to bypass path policy write restrictions via symlink swaps. An     attacker can replace a symlink between policy validation (check-time) and the file write operation (use-     time) to write to policy-denied locations. (CVE-2026-86424)

  - ImageMagick before 7.1.2-30 and 6.9.x before 6.9.13-55 contains a heap-use-after-free vulnerability in the     Layer method of PerlMagick. An attacker who supplies a crafted list of images can trigger memory access     after deallocation, resulting in a crash (denial of service). (CVE-2026-86425)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - ImageMagick before 7.1.2-30 and 6.9.13-55 contains a time-of-check-time-of-use (TOCTOU) vulnerability in     the video decoder that allows attackers to bypass path policy write restrictions via symlink swaps. An     attacker can replace a symlink between policy validation (check-time) and the file write operation (use-     time) to write to policy-denied locations. (CVE-2026-86424)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
474823	Echo: imagemagick: security update to 8:7.1.2.31+dfsg1-1	Tenable Cloud Security	Echo Local Security Checks	Local	low
474823	Echo: imagemagick: security update to 8:7.1.2.31+dfsg1-1	Tenable Self-Hosted Container Security	Echo Local Security Checks	Local	low
366279	Unity Linux 20.1070e Security Update: ImageMagick (UTSA-2026-130377)	Nessus	Unity Linux Local Security Checks	Local	low
365362	AlmaLinux 9.6 [TuxCare] Security Update: ImageMagick / ImageMagick-c++ / ImageMagick-c++-devel / etc Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1791913022)	Nessus	Alma Linux Local Security Checks	Local	medium
365358	AlmaLinux 9.2 [TuxCare] Security Update: ImageMagick / ImageMagick-c++ / ImageMagick-c++-devel / etc Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2026:1791911076)	Nessus	Alma Linux Local Security Checks	Local	medium
365357	Rocky Linux 9.6 [TuxCare] Security Update: ImageMagick / ImageMagick-c++ / ImageMagick-c++-devel / etc Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1791913022)	Nessus	Rocky Linux Local Security Checks	Local	medium
343535	Linux Distros Unpatched Vulnerability : CVE-2026-86424	Nessus	Misc.	Local	low

Detections

Analytics

CVE-2026-86424

low

Tenable Plugins

low

low

low

medium

medium

medium

low