ImageMagick contains a time‑of‑check to time‑of‑use race condition in its path policy enforcement. An attacker can replace a file with a symlink after the policy has been checked but before the file is opened, allowing the software to read or write files outside the intended directory. The flaw is identified as a race condition (CWE‑367) and an improper path restriction (CWE‑59) that can lead to disclosure or modification of protected data. The vulnerability does not give code execution but permits unauthorized access to filesystem objects.

All installations of ImageMagick earlier than version 7.1.2‑16 and 6.9.13‑41 are affected. These versions are widely used in web servers, content management systems, and automated image processing pipelines. Any environment that processes external images with these versions is at risk.

The CVSS score of 6.3 reflects moderate severity. The EPSS score of less than 1% indicates a low probability of exploitation at the time of assessment, and the flaw is not currently listed in the CISA KEV database. Based on the description, it is inferred that exploitation may involve providing malicious image files or manipulating the image processing workflow to trigger the race condition, but this is not explicitly stated in the input; it is a logical deduction from the described TOCTOU behavior.