ImageMagick before 7.1.2‑30 and 6.9.13‑55 contains a time‑of‑check/time‑of‑use flaw in the video decoder that allows an attacker to replace a symlink between policy validation and the actual file write. This race condition can be used to write to paths that are normally protected by the policy configuration, enabling unauthorized modification of privileged files and potential escalation of privileges. The weakness aligns with CWE‑59, a path traversal problem, and CWE‑367, a time‑of‑check/time‑of‑use condition.

The vulnerability affects ImageMagick for all versions prior to 7.1.2‑30 and prior to 6.9.13‑55. Users running those releases of the ImageMagick imaging library are impacted and should note that the policy restrictions they rely on are not enforced until the identified versions are applied.

The CVSS score of 2 indicates a low severity issue. EPSS is not available, implying no evidence of widespread exploitation. The vulnerability is not listed in the CISA KEV catalog. An attacker would need local or controlled access to the image‑processing environment to trigger the race, typically by crafting a malicious image file that the ImageMagick engine parses. Because the flaw is a time‑of‑check/time‑of‑use race condition (CWE‑367) on the filesystem, the likelihood of successful exploitation in the wild is considered low, but the ability to overwrite policy files could provide a foothold for further attacks if an attacker gains any foothold in the system.