CVE-2026-108693: 
ImageMagick Analyse et atténuation des vulnérabilités

CVE-2026-108693 is an uncontrolled search path vulnerability in ImageMagick on Windows that enables arbitrary code execution via a malicious Ghostscript delegate executable. The flaw exists in the NTGhostscriptEXE() function, which launches gswin64c.exe by bare name (without a full path) when Ghostscript is not registered in the Windows registry. An attacker who can write to the working directory from which ImageMagick processes PDF, PostScript, or EPS files can plant a malicious gswin64c.exe to execute code with ImageMagick's privileges. Affected versions are ImageMagick 7.0.0-0 through 7.1.2-33 and all versions through 6.9.13-58 on Windows. The vulnerability was disclosed on October 11, 2026, and carries a CVSS v3.1 base score of 7.0 (High) and a CVSS v4.0 base score of 7.3 (High) (Red Hat Advisory, Red Hat Bugzilla).

The root cause is CWE-427 (Uncontrolled Search Path Element). In MagickCore/nt-base.c, the NTGhostscriptEXE() function attempts to locate the Ghostscript executable by querying the Windows registry; when no registered Ghostscript installation is found, it falls back to invoking gswin64c.exe as a bare executable name without specifying an absolute path (ImageMagick Source). Windows process creation then resolves the executable using its standard search order, which includes the current working directory before entries in PATH. The attack requires that the attacker have write access to the directory from which ImageMagick is invoked (e.g., an upload or extraction directory), and that a user or automated process trigger a PDF/PS/EPS conversion — constituting the required user interaction. A public proof-of-concept repository (ghostx-86/exploitarium) demonstrates the technique using a harmless marker-writing helper named gswin64c.exe (PoC Repo).

Successful exploitation allows an attacker to execute arbitrary code with the privileges of the ImageMagick process on the affected Windows system. All three security pillars are affected: confidentiality (access to data readable by the ImageMagick process), integrity (ability to modify files or system state), and availability (potential for process termination or system disruption). In automated document conversion pipelines — such as web applications that accept user-uploaded PDFs — the impact is elevated because the ImageMagick process may run with elevated service account privileges, enabling lateral movement or persistent access (Red Hat Advisory, PoC Repo).

A public proof-of-concept exists in the ghostx-86/exploitarium GitHub repository, which provides a Python harness and a pre-compiled marker-writing payload to demonstrate the search path hijack (PoC Repo). As of the disclosure date, there is no evidence of in-the-wild exploitation or threat actor attribution. The EPSS score is 0.0, reflecting low current exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires local write access to the working directory and user interaction (triggering a conversion), which limits opportunistic exploitation but remains realistic in shared hosting, CI/CD pipelines, or web upload scenarios (Red Hat Advisory).

1. Identify target environment: Confirm the target Windows system runs ImageMagick 7.1.2-33 or earlier (or 6.9.13-58 or earlier) without a properly registered Ghostscript installation, and that PDF/PS/EPS delegate processing is enabled.
2. Gain write access to working directory: Obtain write access to the directory from which ImageMagick will be invoked — common scenarios include shared upload directories, document processing queues, or extraction folders in web applications.
3. Craft malicious payload: Compile or obtain a malicious executable named gswin64c.exe. This can be a reverse shell, dropper, or any arbitrary payload. The public PoC (ghostx-86/exploitarium) provides a base64-encoded helper as a reference (PoC Repo).
4. Plant the executable: Place the malicious gswin64c.exe in the target working directory (e.g., the upload or conversion directory).
5. Trigger conversion: Cause ImageMagick to process a PDF, PostScript, or EPS file from that directory — either by uploading a crafted file to a web application, placing a file in a watched folder, or social engineering a user to run a conversion command.
6. Code execution achieved: ImageMagick's NTGhostscriptEXE() fails to find a registered Ghostscript path, falls back to the bare name gswin64c.exe, and Windows resolves it to the planted malicious binary in the current working directory, executing it with ImageMagick's process privileges.

• File System: Presence of an unexpected or unsigned gswin64c.exe in directories used as ImageMagick working directories (upload folders, temp directories, document queues); new files written by the ImageMagick process to unusual locations (e.g., marker files, scripts, or executables).
• Process: Unusual child processes spawned by the ImageMagick (magick.exe) process — particularly processes not matching the legitimate Ghostscript installation path (e.g., gswin64c.exe running from C:\uploads\ or C:\temp\ rather than C:\Program Files\gs\).
• Network: Unexpected outbound network connections originating from magick.exe or a child process spawned during a PDF/PS/EPS conversion operation.
• Logs: Windows Event Log entries (Event ID 4688 or Sysmon Event ID 1) showing gswin64c.exe launched from a non-standard path as a child of magick.exe; application logs showing ImageMagick delegate execution with a working-directory-relative Ghostscript path.

A patch is available — users should update ImageMagick to a version beyond 7.1.2-33 (for the 7.x branch) or 6.9.13-58 (for the 6.x branch) once a fixed release is published (GitHub Advisory). Immediate operational mitigations include:

• Set the MAGICK_GHOSTSCRIPT_PATH environment variable to the absolute path of the legitimate Ghostscript bin directory to prevent the bare-name fallback.
• Ensure Ghostscript is properly installed and registered in the Windows registry on all systems running ImageMagick.
• Restrict write permissions on directories used as ImageMagick working directories so that untrusted users cannot plant executables.
• Separate upload, extraction, and conversion working directories, and ensure conversion jobs run from trusted, write-protected locations.
• Disable PDF/PS/EPS delegate processing in ImageMagick's security policy if those formats are not required (PoC Repo, Red Hat Advisory).

The vulnerability was assigned by VulnCheck and tracked by Red Hat's Product Security team via Bugzilla, with a medium severity rating in that context (Red Hat Bugzilla). Early social media activity on Infosec.exchange noted the disclosure shortly after publication. Community discussion has been limited given the local-access requirement and the availability of straightforward mitigations. No major vendor statements beyond Red Hat's tracking entry have been identified at this time.