CVE-2026-108693: 
ImageMagick vulnerability analysis and mitigation

CVE-2026-108693 is an uncontrolled search path (binary planting) vulnerability in ImageMagick on Windows that allows local code execution via a malicious gswin64c.exe placed in the working directory. The flaw exists in the NTGhostscriptEXE() function within MagickCore/nt-base.c, which launches gswin64c.exe by bare name — without a full path — when Ghostscript is not registered in the Windows registry. Affected versions are ImageMagick 7.0.0-0 through 7.1.2-33 and all versions of the 6.x branch through 6.9.13-58 on Windows. The vulnerability was published on October 11, 2026, and assigned by VulnCheck. It carries a CVSS v3.1 base score of 7.0 (High) and a CVSS v4.0 base score of 7.3 (High) (Red Hat Advisory, Red Hat Bugzilla, GitHub Advisory).

The root cause is CWE-427 (Uncontrolled Search Path Element): when Ghostscript is not registered in the Windows registry, NTGhostscriptEXE() in MagickCore/nt-base.c (lines 1469–1511 and 2829–2832) falls back to invoking gswin64c.exe as a bare executable name with no application name set in the Windows process creation API (ImageMagick Source). Windows then resolves the executable using its standard search order, which includes the current working directory before entries in PATH. An attacker who can write a malicious gswin64c.exe to the directory from which ImageMagick is invoked can cause it to be executed instead of the legitimate Ghostscript binary. Exploitation requires that the victim trigger a PDF, PostScript, or EPS conversion operation from a directory the attacker controls or can write to, and that Ghostscript is absent from the registry (e.g., portable or unregistered deployments). A public proof-of-concept Python harness (poc.py) and a marker-writing fake gswin64c.exe are available on GitHub (PoC Repository).

Successful exploitation results in arbitrary code execution with the privileges of the ImageMagick process, which may be elevated in automated document-processing pipelines or server-side conversion services. All three security pillars are affected: confidentiality (access to data readable by the ImageMagick process), integrity (ability to modify files or system state), and availability (potential for process termination or system disruption). In environments where ImageMagick is invoked by a web application or batch service to process user-uploaded PDF/PS/EPS files, an attacker who can also write to the conversion working directory could achieve persistent code execution or lateral movement within the host (Red Hat Advisory, Red Hat Bugzilla).

A public proof-of-concept exists in the ghostx-86/exploitarium GitHub repository, which includes a Python replay harness and a harmless marker-writing fake gswin64c.exe to demonstrate the hijack (PoC Repository). NVD SSVC data classifies exploitation status as "poc" with total technical impact, though the vulnerability is not automatable due to required user interaction and local access preconditions. There is no evidence of in-the-wild exploitation or threat actor attribution at this time. The EPSS score is approximately 0.127%, indicating low near-term exploitation probability. The vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (Red Hat Advisory).

1. Identify target environment: Confirm the target Windows system runs ImageMagick 7.x ≤ 7.1.2-33 or 6.x ≤ 6.9.13-58 and that Ghostscript is either absent from the Windows registry or the MAGICK_GHOSTSCRIPT_PATH environment variable points to a directory without Ghostscript DLLs — triggering the insecure fallback path.
2. Gain write access to working directory: Obtain write permissions to the directory from which ImageMagick will be invoked (e.g., an upload directory, a temp folder used by a document conversion service, or any directory writable by the attacker's user account).
3. Craft malicious payload: Compile or obtain a malicious executable named gswin64c.exe. This can be a reverse shell, a dropper, or any arbitrary payload. The PoC uses a C# helper (FakeGswin64c.cs) compiled to gswin64c.exe as a proof of concept.
4. Plant the malicious executable: Copy the malicious gswin64c.exe into the target working directory alongside or near the PDF/PS/EPS file that will be processed.
5. Trigger ImageMagick conversion: Cause ImageMagick to process a PDF, PostScript, or EPS file from the poisoned working directory — for example, by submitting a file to a web application that invokes magick convert input.pdf output.png, or by social engineering a user to run the conversion.
6. Achieve code execution: ImageMagick's NTGhostscriptEXE() builds a delegate command using the bare name gswin64c.exe and launches it via the Windows process API without specifying an application path. Windows resolves the executable from the current working directory first, executing the attacker's payload with ImageMagick's process privileges (PoC Repository, ImageMagick Source).

• File System: Presence of an unexpected gswin64c.exe in directories used as ImageMagick working directories (e.g., upload folders, temp directories, document conversion staging areas) that does not match the legitimate Ghostscript installation path.
• File System: A marker file (e.g., named via IM_GS_MARKER environment variable) written by a fake gswin64c.exe in the working directory, indicating the PoC or a derivative was executed.
• Process: Child processes spawned by the ImageMagick (magick.exe) process that are not the legitimate gswin64c.exe from the Ghostscript installation directory — check parent-child process relationships and executable paths.
• Process: Unexpected network connections, file writes, or registry modifications initiated by a process named gswin64c.exe running from a non-standard path (i.e., not from C:\Program Files\gs\...\bin\).
• Logs: Windows Event Logs (Security, Event ID 4688) showing gswin64c.exe launched from a working/upload/temp directory rather than the Ghostscript installation directory.
• Network: Outbound connections from gswin64c.exe or magick.exe to unexpected external IP addresses, particularly if ImageMagick is used in a server-side context (PoC Repository).

A patch is available — users should update ImageMagick to a version beyond 7.1.2-33 (7.x branch) or 6.9.13-58 (6.x branch) once a fixed release is published (GitHub Advisory). As an immediate operational workaround, set the MAGICK_GHOSTSCRIPT_PATH environment variable to the absolute path of the legitimate Ghostscript bin directory, which forces ImageMagick to use a full path and bypasses the insecure fallback. Additionally, restrict write permissions on directories used as ImageMagick working directories so that untrusted users or processes cannot plant executables. Where PDF/PS/EPS conversion is not required, disable those delegate formats in ImageMagick's policy configuration. Ensure Ghostscript is properly installed and registered in the Windows registry on all systems running ImageMagick (Red Hat Advisory, PoC Repository).

The vulnerability was noted on Infosec.Exchange shortly after disclosure, with community discussion referencing the public PoC and the insecure delegate handling pattern (Infosec.Exchange). Red Hat tracked the issue via Bugzilla and assigned it medium severity, reflecting the local-access and user-interaction requirements that limit its exploitability in most enterprise environments (Red Hat Bugzilla). Coverage appeared on TechJuice in the context of broader Ghostscript-related security concerns in document processing pipelines.