CVE Alert: CVE-2026-108693 – ImageMagick

ImageMagick on Windows through 7.1.2-33 and 6.9.13-58 contains an uncontrolled path vulnerability in NTGhostscriptEXE() that launches gswin64c.exe by bare name when Ghostscript is unregistered. Attackers can plant a malicious gswin64c.exe in the working directory to execute code with ImageMagick privileges when PDF, PostScript, or EPS files are converted.

**Risk verdict:** High risk for affected Windows workflows; a public PoC is indicated, but KEV, SSVC exploitation status and EPSS data are not provided, so active exploitation urgency cannot be confirmed.

**Why this matters:** Successful execution can give an attacker the same code-execution privileges as the image-processing service or user, potentially exposing files or enabling tampering and disruption. A realistic route is to place a crafted executable where the process will find it, then induce conversion of a supported document.

**Most likely attack path:** The attack is local and requires a planted file and user or service processing of a document, making control of the working directory and conversion workflow key preconditions. No prior privileges are required by the scoring, but interaction is needed; high complexity limits opportunistic exploitation. Scope is unchanged, so direct impact is confined to the compromised process context, though that account may have access to sensitive data or systems.

**Who is most exposed:** Windows systems using image-processing libraries or command-line tools to handle untrusted uploads, email attachments, documents, or automated publishing jobs are most exposed. Risk rises where Ghostscript is not registered and the process runs from a writable directory.

Alert for unexpected `gswin64c.exe` execution by image-conversion processes.

Check working directories and upload/temp paths for untrusted executables with that name.

Review process-creation logs around PDF, PostScript, or EPS conversion events.

Identify conversion services running with broad file or network access.

Mitigation and prioritisation

Confirm exposure and apply a vendor-fixed release; verify the delegate resolves to a trusted Ghostscript path.

Until patched, disable affected document delegates or block these formats where operationally feasible.

Use a controlled, non-writable working directory and remove untrusted executables from locations.

Test conversion workflows before rollout; reduce service-account permissions and monitor for regressions.

A considerable amount of time and effort goes into maintaining this website, creating backend automation and creating new features and content for you to make actionable intelligence decisions. Everyone that supports the site helps enable new functionality.

If you like the site, please support us on Patreon or Buy Me A Coffee using the buttons below.