ImageMagick before version 7.1.2‑32 contains a time‑of‑check time‑of‑use (TOCTOU) symlink race that allows an attacker to swap a verified file path with a symlink while a magick script is running. The vulnerability lets the attacker read files that the security policy is designed to block, enabling the disclosure of protected data.

The flaw exists in all ImageMagick releases prior to 7.1.2‑32. The affected product is the ImageMagick image processing suite; any system running a vulnerable version may be impacted.

The CVSS score of 2.0 classifies the vulnerability as low severity, and the EPSS score is not available. It is not listed in the CISA KEV catalog. The attack requires the ability to execute a magick script and to create or modify symlinks, so it is typically a local or privileged‑execution scenario rather than a remote exploit. Given the low CVSS and absence of known widespread exploitation, the risk is modest but still recommend remediation.