CVE-2026-108693: ImageMagick through 7.1.2-33 and 6.9.13-58 Uncontrolled Search Path via Ghostscript Delegate
ImageMagick on Windows through 7.1.2-33 and 6.9.13-58 contains an uncontrolled search path vulnerability in NTGhostscriptEXE() that launches gswin64c.exe by bare name when Ghostscript is unregistered. Attackers can plant a malicious gswin64c.exe in the working directory to execute code with ImageMagick privileges when PDF, PostScript, or EPS files are converted.
Affected Software
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
Windows systems running ImageMagick through 7.1.2-33 or 6.9.13-58 are exposed when Ghostscript is unregistered and ImageMagick converts PDF, PostScript, or EPS files.
What does an attacker need to exploit it?
An attacker needs to place a malicious gswin64c.exe in ImageMagick's working directory and induce a conversion of a PDF, PostScript, or EPS file. Exploitation also requires user interaction and has high attack complexity according to the supplied vector.
What can be done if updating is not immediately possible?
Avoid converting PDF, PostScript, and EPS files in directories writable by untrusted users, and prevent untrusted users from placing executables in ImageMagick's working directory. Registering Ghostscript may also avoid the described unregistered-Ghostscript code path.
How can I determine whether an installation is affected?
Check whether the installation is on Windows and uses ImageMagick 7.1.2-33 or earlier, or 6.9.13-58 or earlier. Also determine whether Ghostscript is unregistered and whether the deployment performs PDF, PostScript, or EPS conversions.